From 2dd29b8d072c7ae86fa310d60571a195c4b853b5 Mon Sep 17 00:00:00 2001
From: Marius Iversen <marius.iversen@elastic.co>
Date: Tue, 27 Aug 2024 20:26:30 +0200
Subject: [PATCH] [8.15] [Automatic Import] resolve a bug in ECS missing fields
 detection (#191502) (#191526)

# Backport

This will backport the following commits from `main` to `8.15`:
- [[Automatic Import] resolve a bug in ECS missing fields detection
(#191502)](https://github.com/elastic/kibana/pull/191502)

<!--- Backport version: 8.9.8 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Marius
Iversen","email":"marius.iversen@elastic.co"},"sourceCommit":{"committedDate":"2024-08-27T15:52:00Z","message":"[Automatic
Import] resolve a bug in ECS missing fields detection (#191502)\n\n##
Summary\n\nResolves a bug when comparing LLM ECS mapping output with
combined\nsamples, and the mapping is right under the data_stream
object,\nproviding false positive
results.","sha":"fb84360e2e8dd7ef6d8b72687abcead44329c839","branchLabelMapping":{"^v8.16.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","backport:prev-minor","v8.16.0","Team:Security-Scalability","v8.15.1"],"number":191502,"url":"https://github.com/elastic/kibana/pull/191502","mergeCommit":{"message":"[Automatic
Import] resolve a bug in ECS missing fields detection (#191502)\n\n##
Summary\n\nResolves a bug when comparing LLM ECS mapping output with
combined\nsamples, and the mapping is right under the data_stream
object,\nproviding false positive
results.","sha":"fb84360e2e8dd7ef6d8b72687abcead44329c839"}},"sourceBranch":"main","suggestedTargetBranches":["8.15"],"targetPullRequestStates":[{"branch":"main","label":"v8.16.0","labelRegex":"^v8.16.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/191502","number":191502,"mergeCommit":{"message":"[Automatic
Import] resolve a bug in ECS missing fields detection (#191502)\n\n##
Summary\n\nResolves a bug when comparing LLM ECS mapping output with
combined\nsamples, and the mapping is right under the data_stream
object,\nproviding false positive
results.","sha":"fb84360e2e8dd7ef6d8b72687abcead44329c839"}},{"branch":"8.15","label":"v8.15.1","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
---
 .../server/graphs/ecs/validate.ts                   | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/x-pack/plugins/integration_assistant/server/graphs/ecs/validate.ts b/x-pack/plugins/integration_assistant/server/graphs/ecs/validate.ts
index 4695523b14e86..8122b8393f141 100644
--- a/x-pack/plugins/integration_assistant/server/graphs/ecs/validate.ts
+++ b/x-pack/plugins/integration_assistant/server/graphs/ecs/validate.ts
@@ -22,15 +22,10 @@ function extractKeys(data: AnyObject, prefix: string = ''): Set<string> {
       // Directly add the key for arrays without iterating over elements
       keys.add(fullKey);
     } else if (typeof value === 'object' && value !== null) {
-      const valueKeys = new Set(Object.keys(value));
-
-      if ([...valueFieldKeys].every((k) => valueKeys.has(k))) {
-        keys.add(fullKey);
-      } else {
-        // Recursively extract keys if the current value is a nested object
-        for (const nestedKey of extractKeys(value, fullKey)) {
-          keys.add(nestedKey);
-        }
+      keys.add(fullKey);
+      // Recursively extract keys if the current value is a nested object
+      for (const nestedKey of extractKeys(value, fullKey)) {
+        keys.add(nestedKey);
       }
     } else {
       // Add the key if the value is not an object or is null