[Security Solution][Bug] On switching Knowledge Base Index Sharing from Private to Global shows Error updating Knowledge Base Entries (#198891)

[e40pud]

Summary

BUG: #198891

These changes fix the issue with the ES bulk update operation and semantic_text type fields. ES bulk update operation require such fields to be specified even when those are not required in mappings.

The ES returns an error Field [semantic_text] must be specified on an update request to calculate inference for field [semantic_text] in this case.

We do not use sematic_text field for index entries in knowledge base and that is why those entries have this field undefined. To avoid an error we pass a dummy text to satisfy ES.

To test

1. Create an index entry
2. Edit the entry from 1
3. Update the entry (for example change the name)
4. Save entry

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[stephmilovic]

Confirmed that the fix now allows index entry updates. Used the assistant to invoke an updated index entry to confirm that the addition of the mock semantic_text value does not break the custom knowledge base tools. LGTM!!

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 25c7539

Failed CI Steps

• x-pack/test/alerting_api_integration/security_and_spaces/group1/config.ts

Test Failures

• [job] [logs] x-pack/test/alerting_api_integration/security_and_spaces/group1/config.ts / alerting api integration security and spaces enabled Alerts - Group 1 alerts backfill rule runs backfill api key invalidation should wait to invalidate API key until backfill for rule is complete

Metrics [docs]

✅ unchanged

cc @e40pud

[e40pud]

Fixed in elastic/elasticsearch#116478