[google_workspace] drop events that have missing items[] in the raw logs from the API

[brijesh-elastic]

google_workspace: Discard events that are missing the `items[]` field during the split operation
and returned as the root object

The Google Workspace Reports API sometimes does not return the `items[]` array, resulting
in the absence of the target field in the `response.split` operation. This leads to the
root level object being returned, which causes failures in the ingest pipeline.

To address this issue, a `drop` processor has been added at the start of the pipeline to ensure
that we discard events that are not required.

Here is the list of affected data streams:

- access_transparency
- admin
- context_aware_access
- device
- drive
- gcp
- group_enterprise
- groups
- login
- rules
- saml
- token
- user_accounts

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/google_workspace directory.
• Run the following command to run tests.

elastic-package test -v

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 28b3814

cc @brijesh-elastic

[chrisberkhout]

I think the problem, at least as described, should be avoided by using the ignore_empty_value option.

If that's not the case, can you please explain why not?

A system test could exercise this, but I think what's important is to first just understand what is going on.

[brijesh-elastic]

I think the problem, at least as described, should be avoided by using the ignore_empty_value option.
If that's not the case, can you please explain why not?

We already have ignore_empty_value: true set (see here), but events are still being published.
If we have one level of response.split, then the event will be discarded when ignore_empty_value: true is configured.

[chrisberkhout]

If we have one level of response.split, then the event will be discarded when ignore_empty_value: true is configured.

Okay, so it's not working because it's multi-level. That sounds like a beats bug.

I'll take a look there and probably file an issue. If so, we can merge this workaround with a comment that refers to the issue and we should probably also look for the same issue in other integrations.