[Keycloak] Prevent data_stream fields from being overwritten by the log

[SimonKoetting]

The ECS logs of Keycloak contain the data_stream.type field, which is set to logs.
As the pipeline is parsing the message as JSON and overwriting the root object, this leads to the data_stream object being overwritten in the ingest-pipeline so only data_stream.type is stored in the document in ES while dataset & namespace get lost.

This PR removes the data_stream object out of the json generated from the log before it overwrites the data_stream object already present in the event.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: deeb298

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[chrisberkhout]

I think the better way to do this is to modify

integrations/packages/keycloak/data_stream/log/elasticsearch/ingest_pipeline/default.yml

Lines 63 to 69 in 3cae5fc

	- script:
	tag: blat_json_to_ctx
	if: ctx.json instanceof Map
	source: |-
	for (def e: ctx.json.entrySet()) {
	ctx[e.getKey()] = e.getValue();
	}

which was introduced in #14388, to do a deep merge and not overwrite existing data.

---

Side note: if we were going with this PR, it would need the following to make it build with the new version of elastic-package:

diff --git a/packages/keycloak/kibana/dashboard/keycloak-5aecc44a-16d7-47db-805a-245ef0d1bf77.json b/packages/keycloak/kibana/dashboard/keycloak-5aecc44a-16d7-47db-805a-245ef0d1bf77.json
index e54396e0af..90ab7989f8 100644
--- a/packages/keycloak/kibana/dashboard/keycloak-5aecc44a-16d7-47db-805a-245ef0d1bf77.json
+++ b/packages/keycloak/kibana/dashboard/keycloak-5aecc44a-16d7-47db-805a-245ef0d1bf77.json
@@ -908,13 +908,8 @@
             "id": "logs-*",
             "name": "8eb4b16a-a99f-4e5a-9626-e5cf691e1e66:indexpattern-datasource-layer-885448e8-6f26-4229-893f-b5eca782158b",
             "type": "index-pattern"
-        },
-        {
-            "id": "keycloak-security-solution-default",
-            "name": "tag-ref-security-solution-default",
-            "type": "tag"
         }
     ],
     "type": "dashboard",
     "typeMigrationVersion": "8.9.0"
-}
\ No newline at end of file
+}
diff --git a/packages/keycloak/kibana/tag/keycloak-security-solution-default.json b/packages/keycloak/kibana/tag/keycloak-security-solution-default.json
deleted file mode 100644
index b909ee237b..0000000000
--- a/packages/keycloak/kibana/tag/keycloak-security-solution-default.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-    "attributes": {
-        "color": "#F583B7",
-        "description": "Tag defined in package-spec",
-        "name": "Security Solution"
-    },
-    "coreMigrationVersion": "8.8.0",
-    "created_at": "2025-04-28T11:29:23.759Z",
-    "id": "keycloak-security-solution-default",
-    "managed": false,
-    "references": [],
-    "type": "tag",
-    "typeMigrationVersion": "8.0.0"
-}
\ No newline at end of file

[chrisberkhout]

@SimonKoetting Here's the more general fix I think we should do: #17430

[SimonKoetting]

@chrisberkhout all right, fine for me :) I'll go ahead and close this PR. Thanks!