[EEM] Fix ingest pipeline to not overwrite existing parents in metadata

[simianhacker]

Summary

This fixes #186668 by adding a check to see if a HashMap exists before creating a new one. This happens when the ingest pipeline converts the output from a transfrom's terms sub-aggregation output to a list of terms.

Testing

Use Syntrace to generate data with this command:

node scripts/synthtrace packages/kbn-apm-synthtrace/src/scenarios/continuous_rollups.ts --live

Then create this Entity definition:

POST kbn:/internal/api/entities/definition
{
  "id": "apm-countinuous-rollups",
  "name": "Services for APM",
  "type": "service",
  "indexPatterns": ["logs-*", "metrics-*", "traces-*"],
  "history": {
    "timestampField": "@timestamp",
    "interval": "1m"
  },
  "identityFields": ["service.name", "service.environment"],
  "displayNameTemplate": "{{service.name}}:{{service.environment}}",
  "metadata": [
    "host.name",
    "transaction.name",
    "transaction.type",
    "observer.version"
  ],
  "metrics": [
    {
      "name": "latency",
      "equation": "A",
      "metrics": [
        {
          "name": "A",
          "aggregation": "avg",
          "field": "transaction.duration.histogram"
        }
      ]
    },
    {
      "name": "throughput",
      "equation": "A / 5",
      "metrics": [
        {
          "name": "A",
          "aggregation": "doc_count"
        }
      ]
    },
    {
      "name": "failedTransRate",
      "equation": "A / B",
      "metrics": [
        {
          "name": "A",
          "aggregation": "doc_count",
          "filter": "event.outcome: \"failure\""
        },
        {
          "name": "B",
          "aggregation": "doc_count",
          "filter": "event.outcome: *"
        }
      ]
    }
  ]
}

Query the history with:

POST .entities-observability.history-v1.*/_search?track_total_hits=true
{
  "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ]
}

and query the latest with:

POST .entities-observability.latest-v1.*/_search?track_total_hits=true
{}

You should see transaction.name with a list of transactions and transaction.type with a list of the different transaction types.

[obltmachine]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/obs-knowledge-team (Team:obs-knowledge)

[tommyers-elastic]

LGTM

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: d8853c8
• Storybooks Preview
• Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-186672-d8853c8650a0
• Observability Deployment

Failed CI Steps

• Jest Integration Tests #3

Metrics [docs]

✅ unchanged

History

• 💛 Build #217260 was flaky 3e8aea5

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream