From 2d82be07c8fa1b0b9788df758730e0382706f391 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 24 Sep 2024 01:42:37 +1000
Subject: [PATCH] [8.15] [Automatic Import] Do not remove message field for
 unstructured logs (#193678) (#193702)

# Backport

This will backport the following commits from `main` to `8.15`:
- [[Automatic Import] Do not remove message field for unstructured logs
(#193678)](https://github.com/elastic/kibana/pull/193678)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Bharat
Pasupula","email":"123897612+bhapas@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-09-23T11:08:59Z","message":"[Automatic
Import] Do not remove message field for unstructured logs
(#193678)","sha":"2106df354adaa48dae7d8457b7d3401104724fc9","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","v9.0.0","backport:prev-major","Team:Security-Scalability","Feature:AutomaticImport"],"title":"[Automatic
Import] Do not remove message field for unstructured
logs","number":193678,"url":"https://github.com/elastic/kibana/pull/193678","mergeCommit":{"message":"[Automatic
Import] Do not remove message field for unstructured logs
(#193678)","sha":"2106df354adaa48dae7d8457b7d3401104724fc9"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/193678","number":193678,"mergeCommit":{"message":"[Automatic
Import] Do not remove message field for unstructured logs
(#193678)","sha":"2106df354adaa48dae7d8457b7d3401104724fc9"}}]}]
BACKPORT-->

Co-authored-by: Bharat Pasupula <123897612+bhapas@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../integration_assistant/server/templates/pipeline.yml.njk   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/integration_assistant/server/templates/pipeline.yml.njk b/x-pack/plugins/integration_assistant/server/templates/pipeline.yml.njk
index ba846dc50fba92..d583d68c4b733a 100644
--- a/x-pack/plugins/integration_assistant/server/templates/pipeline.yml.njk
+++ b/x-pack/plugins/integration_assistant/server/templates/pipeline.yml.njk
@@ -19,11 +19,11 @@ processors:
       field: originalMessage
       ignore_missing: true
       tag: remove_copied_message
-      if: 'ctx.event?.original != null'
+      if: 'ctx.event?.original != null'{% if log_format != 'unstructured' %}
   - remove:
       field: message
       ignore_missing: true
-      tag: remove_message{% if (log_format == 'json') or (log_format == 'ndjson') %}
+      tag: remove_message{% endif %}{% if (log_format == 'json') or (log_format == 'ndjson') %}
   - json:
       field: event.original
       tag: json_original