[Box Events] Update field mapping to account for non-boolean values

[KyleOnK8s]

Proposed commit message

Box Events sends either null or an email to box.source.login when using the admin_logs_streaming setting. Setting this field to a boolean causes data set quality issues and fields to become ignored.

Changing this to a keyword should resolve issues with data set quality.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

How to test this PR locally

Related issues

• Closes [Box Events]: box.source.login is not always boolean #17412

Screenshots

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: af9d524

Failed CI Steps

• Check integrations box_events

History

[efd6]

This needs an elastic-package build (or just the application of the following diff):

diff --git a/packages/box_events/docs/README.md b/packages/box_events/docs/README.md
index 1b09c46a4d..f3437d7c42 100644
--- a/packages/box_events/docs/README.md
+++ b/packages/box_events/docs/README.md
@@ -227,7 +227,7 @@ Preserves a raw copy of the original event, added to the field `event.original`.
 | box.source.item_status | Defines if this item has been deleted or not. active when the item has is not in the trash trashed when the item has been moved to the trash but not deleted deleted when the item has been permanently deleted. Value is one of `active`, `trashed`, `deleted` | keyword |
 | box.source.job_title | User job title | boolean |
 | box.source.language | User preferred language | boolean |
-| box.source.login | User login | boolean |
+| box.source.login | User login | keyword |
 | box.source.max_upload_size | Max upload size | boolean |
 | box.source.modified_at | The date and time at which this folder was last updated | date |
 | box.source.modified_by.id | The unique identifier for this user that last modified the file. | keyword |

Can you add a test for this? There is no event in the pipeline tests for this field, which is presumably why it has persisted so long.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)