github: fix template field indexing when link is absent in header

brijesh-elastic · web-flow · commit b62afcf963ef · 2025-12-03T10:39:03.000+05:30
Don't update fleet health status to degraded when HTTPJSON template
evaluation fails due to an absent Link field in the header.

This change bumps minimum kibana version to ^8.19.4 || ~9.0.7 || ^9.1.4
diff --git a/packages/github/_dev/deploy/docker/files/config.yml b/packages/github/_dev/deploy/docker/files/config.yml
@@ -14,6 +14,8 @@ rules:
             - application/json
           Link:
             - '<http://{{ hostname }}:{{ env "PORT" }}/orgs/test/audit-log?after=abcd>; rel="next"'
+          X-RateLimit-Remaining:
+            - 59
         body: |
           [{
             "@timestamp": 1606929874512,
@@ -51,6 +53,8 @@ rules:
         headers:
           Content-Type:
             - application/json
+          X-RateLimit-Remaining:
+            - 58
         body: |-
           [{
             "@timestamp": 1606929874512,
@@ -92,6 +96,8 @@ rules:
             - application/json
           Link:
             - '<http://{{ hostname }}:{{ env "PORT" }}/orgs/test/audit-log?after=abcd>; rel="next"'
+          X-RateLimit-Remaining:
+            - 59
         body: |
           [{
             "@timestamp": 1606929874512,
@@ -129,6 +135,8 @@ rules:
         headers:
           Content-Type:
             - application/json
+          X-RateLimit-Remaining:
+            - 58
         body: |-
           [{
             "@timestamp": 1606929874512,
@@ -166,6 +174,8 @@ rules:
             - application/json
           Link:
             - '<http://{{ hostname }}:{{ env "PORT" }}/repos/sample_owner/sample_repo/code-scanning/alerts>; rel="next"'
+          X-RateLimit-Remaining:
+            - 59
         body: |-
           [{
             "number": 91,
@@ -275,6 +285,8 @@ rules:
             - application/json
           Link:
             - '<http://{{ hostname }}:{{ env "PORT" }}/repos/sample_owner/sample_repo/secret-scanning/alerts>; rel="next"'
+          X-RateLimit-Remaining:
+            - 59
         body: |-
           [{
             "number": 3,
@@ -332,6 +344,8 @@ rules:
         headers:
           Content-Type:
             - application/json
+          X-RateLimit-Remaining:
+            - 59
         body: |-
           {
             "data": {
@@ -563,6 +577,8 @@ rules:
             - application/json
           Link:
             - '<http://{{ hostname }}:{{ env "PORT" }}/repos/sample_owner/sample_repo/issues?page=2>; rel="next"'
+          X-RateLimit-Remaining:
+            - 59
         body: |
           [{
             "url": "https://api.github.com/repos/elastic/integrations/issues/4703",
@@ -790,6 +806,8 @@ rules:
         headers:
           Content-Type:
             - application/json
+          X-RateLimit-Remaining:
+            - 58
         body: |-
           [{
             "id": 1,
diff --git a/packages/github/changelog.yml b/packages/github/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.18.0"
+  changes:
+    - description: Prevent updating the fleet health status to degraded when the link is not present in the header.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/16149
 - version: "2.17.3"
   changes:
     - description: Fix HTTPJSON cursor logic for audit data stream.
diff --git a/packages/github/data_stream/audit/agent/stream/httpjson.yml.hbs b/packages/github/data_stream/audit/agent/stream/httpjson.yml.hbs
@@ -49,15 +49,15 @@ request.rate_limit.remaining: '[[ .last_response.header.Get "X-RateLimit-Remaini
 response.pagination:
   - set:
       target: url.value
-      value: '[[ getRFC5988Link "next" .last_response.header.Link ]]'
+      value: '[[ if index .last_response.header "Link" ]][[ getRFC5988Link "next" .last_response.header.Link ]][[ end ]]'
       fail_on_template_error: true
       do_not_log_failure: true
 
 cursor:
   last_timestamp:
     value: >-
       [[- if index .last_event "@timestamp" -]]
-        [[- .last_event.Get "@timestamp" -]]
+        [[- index .last_event "@timestamp" -]]
       [[- else -]]
         [[- .last_event.created_at -]]
       [[- end -]]
diff --git a/packages/github/data_stream/audit/sample_event.json b/packages/github/data_stream/audit/sample_event.json
@@ -1,24 +1,24 @@
 {
     "@timestamp": "2020-11-18T17:05:48.837Z",
     "agent": {
-        "ephemeral_id": "dfb11704-8962-47d6-b6db-273d5f5ceebc",
-        "id": "0f34c9a0-5d22-445a-a67c-213c32486e64",
-        "name": "elastic-agent-94967",
+        "ephemeral_id": "c09b35c2-fdcc-49ac-8a3a-6115c04e0ecc",
+        "id": "28342e9d-df80-4a76-b0ec-5d8aab2b7adc",
+        "name": "elastic-agent-20025",
         "type": "filebeat",
-        "version": "8.18.0"
+        "version": "8.19.4"
     },
     "data_stream": {
         "dataset": "github.audit",
-        "namespace": "33218",
+        "namespace": "96282",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "0f34c9a0-5d22-445a-a67c-213c32486e64",
+        "id": "28342e9d-df80-4a76-b0ec-5d8aab2b7adc",
         "snapshot": false,
-        "version": "8.18.0"
+        "version": "8.19.4"
     },
     "event": {
         "action": "repo.destroy",
@@ -27,10 +27,10 @@
             "configuration",
             "web"
         ],
-        "created": "2025-07-29T06:21:44.111Z",
+        "created": "2025-11-24T10:06:23.406Z",
         "dataset": "github.audit",
         "id": "LwW2vpJZCDS-WUmo9Z-ifw",
-        "ingested": "2025-07-29T06:21:45Z",
+        "ingested": "2025-11-24T10:06:24Z",
         "kind": "event",
         "original": "{\"@timestamp\":1605719148837,\"_document_id\":\"LwW2vpJZCDS-WUmo9Z-ifw\",\"action\":\"repo.destroy\",\"actor\":\"monalisa\",\"created_at\":1605719148837,\"org\":\"mona-org\",\"repo\":\"mona-org/mona-test-repo\",\"visibility\":\"private\"}",
         "type": [
diff --git a/packages/github/data_stream/code_scanning/agent/stream/httpjson.yml.hbs b/packages/github/data_stream/code_scanning/agent/stream/httpjson.yml.hbs
@@ -32,7 +32,7 @@ request.rate_limit.remaining: '[[ .last_response.header.Get "X-RateLimit-Remaini
 response.pagination:
   - set:
       target: url.value
-      value: '[[ getRFC5988Link "next" .last_response.header.Link ]]'
+      value: '[[ if index .last_response.header "Link" ]][[ getRFC5988Link "next" .last_response.header.Link ]][[ end ]]'
       fail_on_template_error: true
       do_not_log_failure: true
 
diff --git a/packages/github/data_stream/code_scanning/sample_event.json b/packages/github/data_stream/code_scanning/sample_event.json
@@ -1,30 +1,30 @@
 {
     "@timestamp": "2022-06-29T18:03:27.000Z",
     "agent": {
-        "ephemeral_id": "6f5c6543-1ec5-4ebd-92ca-19a9411e709f",
-        "id": "dea91ede-5989-4df4-bcc2-52d312289c0f",
-        "name": "elastic-agent-33638",
+        "ephemeral_id": "a8d5c536-dff6-4072-9594-3833ba1eb159",
+        "id": "dfc3f7de-e5e1-4502-a207-fc0596cae3aa",
+        "name": "elastic-agent-29299",
         "type": "filebeat",
-        "version": "8.16.0"
+        "version": "8.19.4"
     },
     "data_stream": {
         "dataset": "github.code_scanning",
-        "namespace": "46044",
+        "namespace": "52388",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "dea91ede-5989-4df4-bcc2-52d312289c0f",
+        "id": "dfc3f7de-e5e1-4502-a207-fc0596cae3aa",
         "snapshot": false,
-        "version": "8.16.0"
+        "version": "8.19.4"
     },
     "event": {
         "agent_id_status": "verified",
         "created": "2022-06-29T18:03:27.000Z",
         "dataset": "github.code_scanning",
-        "ingested": "2025-07-09T06:54:31Z",
+        "ingested": "2025-11-24T10:02:53Z",
         "original": "{\"created_at\":\"2022-06-29T18:03:27Z\",\"html_url\":\"https://github.com/sample_owner/sample_repo/security/code-scanning/91\",\"most_recent_instance\":{\"analysis_key\":\".github/workflows/codeql-analysis.yml:analyze\",\"category\":\".github/workflows/codeql-analysis.yml:analyze/language:javascript\",\"classifications\":[],\"commit_sha\":\"3244e8b15cc1b8f2732eecd69fc1890b737f0dda\",\"location\":{\"end_column\":50,\"end_line\":67,\"path\":\"routes/chatbot.ts\",\"start_column\":23,\"start_line\":67},\"message\":{\"text\":\"(Experimental) This may be a database query that depends on a user-provided value. Identified using machine learning.(Experimental) This may be a database query that depends on a user-provided value. Identified using machine learning.\"},\"ref\":\"refs/heads/master\",\"state\":\"open\"},\"number\":90,\"rule\":{\"description\":\"SQL database query built from user-controlled sources (experimental)\",\"id\":\"js/ml-powered/sql-injection\",\"security_severity_level\":\"high\",\"severity\":\"error\",\"tags\":[\"experimental\",\"external/cwe/cwe-089\",\"security\"]},\"state\":\"open\",\"tool\":{\"name\":\"CodeQL\",\"version\":\"2.9.4\"},\"updated_at\":\"2022-06-29T18:03:27Z\",\"url\":\"https://api.github.com/repos/sample_owner/sample_repo/code-scanning/alerts/91\"}",
         "type": [
             "creation"
diff --git a/packages/github/data_stream/issues/agent/stream/httpjson.yml.hbs b/packages/github/data_stream/issues/agent/stream/httpjson.yml.hbs
@@ -27,15 +27,19 @@ request.transforms:
   - set:
       target: url.params.state
       value: '{{state}}'
+      do_not_log_failure: true
   - set:
       target: url.params.filter
       value: '{{filter}}'
+      do_not_log_failure: true
   - set:
       target: url.params.labels
       value: '{{labels}}'
+      do_not_log_failure: true
   - set:
       target: url.params.since
       value: '{{since}}'
+      do_not_log_failure: true
   - set:
       target: url.params.per_page
       value: 100
@@ -47,7 +51,7 @@ request.rate_limit.remaining: '[[ .last_response.header.Get "X-RateLimit-Remaini
 response.pagination:
   - set:
       target: url.value
-      value: '[[ getRFC5988Link "next" .last_response.header.Link ]]'
+      value: '[[ if index .last_response.header "Link" ]][[ getRFC5988Link "next" .last_response.header.Link ]][[ end ]]'
       fail_on_template_error: true
       do_not_log_failure: true
 
diff --git a/packages/github/data_stream/issues/sample_event.json b/packages/github/data_stream/issues/sample_event.json
@@ -1,30 +1,30 @@
 {
     "@timestamp": "2011-04-22T13:33:48.000Z",
     "agent": {
-        "ephemeral_id": "2104d082-ca1c-4f37-af08-a3c618b7a1b1",
-        "id": "82ca2524-bffb-48d1-8b37-a9bf993e6898",
-        "name": "elastic-agent-93717",
+        "ephemeral_id": "a263f7f1-a457-4b20-ae6e-458f8bf47a03",
+        "id": "716707b5-76c9-4707-b805-cfe61efc5968",
+        "name": "elastic-agent-58663",
         "type": "filebeat",
-        "version": "8.16.0"
+        "version": "8.19.4"
     },
     "data_stream": {
         "dataset": "github.issues",
-        "namespace": "15567",
+        "namespace": "85867",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "82ca2524-bffb-48d1-8b37-a9bf993e6898",
+        "id": "716707b5-76c9-4707-b805-cfe61efc5968",
         "snapshot": false,
-        "version": "8.16.0"
+        "version": "8.19.4"
     },
     "event": {
         "agent_id_status": "verified",
         "created": "2011-04-22T13:33:48.000Z",
         "dataset": "github.issues",
-        "ingested": "2025-07-09T06:57:42Z",
+        "ingested": "2025-11-24T10:11:01Z",
         "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}",
         "type": [
             "creation"
diff --git a/packages/github/data_stream/secret_scanning/agent/stream/httpjson.yml.hbs b/packages/github/data_stream/secret_scanning/agent/stream/httpjson.yml.hbs
@@ -35,7 +35,7 @@ request.rate_limit.remaining: '[[ .last_response.header.Get "X-RateLimit-Remaini
 response.pagination:
   - set:
       target: url.value
-      value: '[[ getRFC5988Link "next" .last_response.header.Link ]]'
+      value: '[[ if index .last_response.header "Link" ]][[ getRFC5988Link "next" .last_response.header.Link ]][[ end ]]'
       fail_on_template_error: true
       do_not_log_failure: true
 
diff --git a/packages/github/data_stream/secret_scanning/sample_event.json b/packages/github/data_stream/secret_scanning/sample_event.json
@@ -1,30 +1,30 @@
 {
     "@timestamp": "2022-06-30T18:07:27.000Z",
     "agent": {
-        "ephemeral_id": "469df46a-95c5-4dad-80a8-e6a85c09e9b6",
-        "id": "6c25a893-0a1b-4b3d-98e9-bb6681c5fa62",
-        "name": "elastic-agent-90778",
+        "ephemeral_id": "0ab1b8c7-ade2-42a6-abd9-1ad982cff568",
+        "id": "5980590c-e9fd-49fd-a2a4-365727917f35",
+        "name": "elastic-agent-51688",
         "type": "filebeat",
-        "version": "8.16.0"
+        "version": "8.19.4"
     },
     "data_stream": {
         "dataset": "github.secret_scanning",
-        "namespace": "59764",
+        "namespace": "68527",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "6c25a893-0a1b-4b3d-98e9-bb6681c5fa62",
+        "id": "5980590c-e9fd-49fd-a2a4-365727917f35",
         "snapshot": false,
-        "version": "8.16.0"
+        "version": "8.19.4"
     },
     "event": {
         "agent_id_status": "verified",
         "created": "2022-06-30T18:07:27Z",
         "dataset": "github.secret_scanning",
-        "ingested": "2025-07-09T06:58:29Z",
+        "ingested": "2025-11-24T10:09:12Z",
         "original": "{\"created_at\":\"2022-06-30T18:07:27Z\",\"html_url\":\"https://github.com/sample_owner/sample_repo/security/secret-scanning/3\",\"number\":3,\"push_protection_bypassed\":true,\"push_protection_bypassed_by\":{\"html_url\":\"https://github.com/sample_owner\",\"login\":\"sample_owner\",\"type\":\"User\",\"url\":\"https://api.github.com/users/sample_owner\"},\"resolution\":\"revoked\",\"resolved_by\":{\"login\":\"sample_owner\",\"type\":\"User\",\"url\":\"https://api.github.com/users/sample_owner\"},\"secret\":\"npm_2vYJ3QzGXoGbEgMYduYS1k2M4D0wDu2opJbl\",\"secret_type\":\"npm_access_token\",\"secret_type_display_name\":\"npm Access Token\",\"state\":\"open\",\"url\":\"https://api.github.com/repos/sample_owner/sample_repo/secret-scanning/alerts/3\"}",
         "type": [
             "creation"
diff --git a/packages/github/docs/README.md b/packages/github/docs/README.md
diff --git a/packages/github/manifest.yml b/packages/github/manifest.yml
