[zoom] Add support for the meeting activity data stream by brijesh-elastic · Pull Request #19554 · elastic/integrations

brijesh-elastic · 2026-06-16T11:38:36Z

Proposed commit message

zoom: add support for meeting activity data stream

This data stream collects meeting activity logs.
API documentation is available here[1] and test samples were derived from documentation.

[1] https://developers.zoom.us/docs/api/meetings/#tag/reports/get/report/meeting_activities

Note

To Reviewers:

This data stream has not been tested with a live instance.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/zoom directory.
Run the following command to run tests.

elastic-package test -v

Related issues

Relates [zoom] Add API support for operations logs #15236

github-actions · 2026-06-16T11:40:40Z

Elastic Docs Style Checker (Vale)

Summary: 2 warnings found

⚠️ Warnings (2): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/zoom/_dev/build/docs/README.md	5	Elastic.EndPuntuaction	Don't end headings with punctuation.
packages/zoom/manifest.yml	71	Elastic.DontUse	Don't use 'Please'.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

elastic-vault-github-plugin-prod · 2026-06-16T12:01:36Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

infra-vault-gh-plugin-prod · 2026-07-08T14:23:14Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

vera-review-bot · 2026-07-08T14:36:36Z

+            }
+        ],
+        "timeRestore": false,
+        "title": "[Logs Zoom] Meeting Activity Overview  ",


Severity: 🟡 Medium confidence: high path: packages/zoom/kibana/dashboard/zoom-c98a711f-7bd1-4586-b45c-c88f319815c3.json:616

The new Meeting Activity dashboard title contains stray object-replacement/garbage characters — remove them so the title reads cleanly.

Details

The dashboard title is [Logs Zoom] Meeting Activity Overview — it ends with two U+FFFC object-replacement characters (they render as broken/blank glyphs in the Kibana saved-object list and dashboard header). The same corrupted text is also present in this dashboard's own navigation-link label on line 127. This looks like an image/object was accidentally pasted into the title field. It is user-visible on every install.

Recommendation:

Strip the trailing garbage characters from the title (line 616) and the navigation label (line 127):

{ "title": "[Logs Zoom] Meeting Activity Overview", "version": 3 }

and for the nav link label:

{ "label": "Meeting Activity Overview", "order": 2, "type": "dashboardLink" }

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

vera-review-bot · 2026-07-08T14:36:36Z

+                            {
+                                "destinationRefName": "link_8dc0d201-40d6-4d97-a286-bd871a49c82d_dashboard",
+                                "id": "8dc0d201-40d6-4d97-a286-bd871a49c82d",
+                                "label": "Meeting Activity Overview  ",


Severity: 🔵 Low confidence: high path: packages/zoom/kibana/dashboard/zoom-33a271ce-059a-4a0a-aa9b-d8615247d5a1.json:402

The Meeting Activity navigation link added to the Operation dashboard carries the same garbage characters in its label — clean it up.

Details

The navigation link to the Meeting Activity dashboard uses the label Meeting Activity Overview , which includes the same two U+FFFC object-replacement characters as the new dashboard's title. This label is shown in the cross-dashboard navigation panel, so users see the broken glyphs.

Recommendation:

Remove the trailing characters from the link label:

{ "label": "Meeting Activity Overview", "order": 2, "type": "dashboardLink" }

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

vera-review-bot · 2026-07-08T14:36:36Z

+                            {
+                                "destinationRefName": "link_75126e52-9f8a-4e72-a9fc-d30e8da52553_dashboard",
+                                "id": "75126e52-9f8a-4e72-a9fc-d30e8da52553",
+                                "label": "Meeting Activity Overview  ",


Severity: 🔵 Low confidence: high path: packages/zoom/kibana/dashboard/zoom-e9055606-5d33-4f84-b883-4498c22b6dbc.json:583

The Meeting Activity navigation link added to the Activity dashboard also carries the garbage characters in its label — clean it up.

Details

Same defect as the Operation dashboard: the navigation link to the Meeting Activity dashboard uses the label Meeting Activity Overview with two trailing U+FFFC object-replacement characters, visible in the navigation panel.

Recommendation:

Remove the trailing characters from the link label:

{ "label": "Meeting Activity Overview", "order": 2, "type": "dashboardLink" }

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

vera-review-bot · 2026-07-08T14:36:36Z

+        show_user: false
+        default:
+          - forwarded
+          - zoom-meeting_activity


Severity: 🔵 Low confidence: high path: packages/zoom/data_stream/meeting_activity/manifest.yml:80

The default tag in the manifest (zoom-meeting_activity) does not match the tag used in the system test and sample event (zoom-meeting-activity) — align them so the documented sample matches what is actually emitted.

Details

The manifest ships the default tag zoom-meeting_activity (underscore), but the system test config (_dev/test/system/test-default-config.yml) and the generated sample_event.json / README example both use zoom-meeting-activity (hyphen). Because the sample event was generated under the test config, the tag shown in the docs will not match the tag a real deployment emits. The sibling streams use a hyphen style (zoom-activity, zoom-operation).

Recommendation:

Make the manifest default consistent with the system test and sample event (and the sibling hyphen style):

- name: tags type: text title: Tags multi: true required: true show_user: false default: - forwarded - zoom-meeting-activity

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

I've updated the system test config file to be consistent.

vera-review-bot · 2026-07-08T14:36:36Z

+      - name: initial_interval
+        type: text
+        title: Initial Interval
+        description: How far back to pull the Meeting Activity logs from Zoom API. Supported units for this parameter are h/m/s.


Severity: 🔵 Low confidence: medium path: packages/zoom/data_stream/meeting_activity/manifest.yml:20

The activity_type variable description lists category names (User Join, User Left) that differ from the values the API returns (User joined, User left) — align the wording to avoid confusing operators.

Details

The activity_type description enumerates selectable categories as All Activities, Meeting Created, Meeting Started, User Join, User Left, Remote Control, In-Meeting Chat and Meeting Ended. The activity_category values seen in the test fixtures and sample are worded differently (e.g. User joined, User left, Meeting ended). If these strings are what the operator must type into the query parameter, the documented list should match the exact accepted values to avoid mis-configuration.

Recommendation:

Confirm the exact accepted activity_type query values against the Zoom GET /report/meeting_activities reference and list them verbatim, e.g.:

- name: activity_type type: text title: Activity Type description: >- The meeting activity category to collect. Available categories are `All Activities`, `Meeting Created`, `Meeting Started`, `User Joined`, `User Left`, `Remote Control`, `In-Meeting Chat` and `Meeting Ended`. required: true show_user: true default: All Activities

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

According to the documentation, the currently listed enums in the descriptions are correct.

vera-review-bot · 2026-07-09T14:25:27Z

+              (resp.StatusCode == 200) ?
+                resp.Body.decode_json().as(body,
+                  body.?meeting_activity_logs.orValue([]).as(logs,
+                    body.?next_page_token.as(next_token,


Severity: 🟠 High confidence: medium path: packages/zoom/data_stream/meeting_activity/agent/stream/cel.yml.hbs:110

Pagination token is treated as present-with-value via .hasValue(), but Zoom returns an empty-string next_page_token on the last page; restore the empty-string guard so a window terminates instead of looping.

Details

The delta replaced the empty-string token guard with body.?next_page_token.as(next_token, ...) and drives want_more, next.page_token, and cursor.poll_start off next_token.hasValue(). hasValue() is true whenever the next_page_token key is present — including when its value is "". Zoom's Report endpoints return next_page_token as an empty string on the terminal page, not by omitting the key: the sibling operation and activity data streams in this same package (same endpoint family, same author) deliberately guard this with .orValue("") != "". If Zoom returns next_page_token: "", this stream keeps want_more: true, carries next.page_token: "", and freezes cursor.poll_start at from_date. On the next execution, has(state.?next.page_token) is true (key present, value empty), so the window is re-requested with an empty next_page_token query param and never advances — a non-terminating pagination loop that repeatedly hammers a Heavy, rate-limited API and never progresses past the first window. The system-test mock (config-meeting_activity.yml) omits next_page_token on its terminal pages rather than returning "", so the pipeline/system tests pass without exercising the real-world empty-string case.

Recommendation:

Normalize the token to a string and treat empty as terminal, matching the sibling operation/activity streams:

body.?next_page_token.orValue("").as(next_token, { "events": (size(logs) > 0) ? dyn(logs.map(e, {"message": e.encode_json()})) : dyn([{"retry": true}]), "want_more": next_token != "" || to_date != now.format("2006-01-02"), "next": (next_token != "") ? {"page_token": next_token} : {}, "cursor": { "poll_start": (next_token != "") ? from_date : to_date, }, } )

Also restore the empty-string guard when sending the token in Step 4 so an empty token is never emitted as a query parameter:

?"next_page_token": state.?next.page_token.optFlatMap(v, (v != "") ? optional.of([v]) : optional.none() ),

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

but Zoom returns an empty-string next_page_token on the last page

Can you check this? If it's true, don't see the field in the case that the value is "".

The 1cb3cbc handles the scenario where next_page_token can be empty.

elastic-vault-github-plugin-prod · 2026-07-10T07:11:58Z

✅ All changelog entries have the correct PR link.

vera-review-bot · 2026-07-10T07:16:12Z

+                            "events": []
+                        }
+                    },
+                    "savedObjectId": "38f3c269-6819-44ab-9c5b-96ab21314352",


Severity: 🟡 Medium confidence: medium path: packages/zoom/kibana/dashboard/zoom-c98a711f-7bd1-4586-b45c-c88f319815c3.json:560

The Meeting Activity dashboard's search panel sets an unprefixed savedObjectId (38f3c269-...), inconsistent with its own zoom-38f3c269-... reference and the zoom- prefixed form this same PR applied to the Operation dashboard; prefix it.

Details

The 'Meeting Activity Essential Details' by-reference search panel declares "savedObjectId": "38f3c269-6819-44ab-9c5b-96ab21314352" (no package prefix), but the matching entry in this dashboard's references array — and the search saved object file itself — use the prefixed id zoom-38f3c269-6819-44ab-9c5b-96ab21314352. This same PR normalized the equivalent field on the sibling Operation dashboard (7735ceba-... -> zoom-7735ceba-...) and the Activity dashboard already uses the prefixed form, so the new dashboard is the only one left with the bare id. The panel resolves at runtime via panelRefName, so the impact is limited, but the hardcoded unprefixed id is a stale/inconsistent reference that contradicts the fix made elsewhere in this change.

Recommendation:

Prefix the panel's savedObjectId to match the references array and the sibling dashboards:

"savedObjectId": "zoom-38f3c269-6819-44ab-9c5b-96ab21314352",

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

It's nothing to worry about. I tried to re-export it, but the elastic-package export dashboards command gives the savedObjectId without the zoom- prefix.

vera-review-bot · 2026-07-10T07:16:14Z

Review summary

Issues found across the latest commits 1cb3cbc — 1 medium

🟡 The Meeting Activity dashboard's search panel sets an unprefixed savedObjectId (38f3c269-...), inconsistent with its own zoom-38f3c269-... reference and the zoom- prefixed form this same PR applied to the Operation dashboard (link) (Unresolved)

Issues found across earlier commits b2dd6fb — 1 high

🟠 Pagination token is treated as present-with-value via .hasValue(), but Zoom returns an empty-string next_page_token on the last page (link) (Unresolved)

Issues found across earlier commits e17b9ef — 1 medium, 4 low

🟡 The new Meeting Activity dashboard title contains stray object-replacement/garbage characters — remove them so the title reads cleanly. (link) (Unresolved)
🔵 The Meeting Activity navigation link added to the Operation dashboard carries the same garbage characters in its label — clean it up. (link) (Unresolved)
🔵 The Meeting Activity navigation link added to the Activity dashboard also carries the garbage characters in its label — clean it up. (link) (Unresolved)
🔵 The default tag in the manifest (zoom-meeting_activity) does not match the tag used in the system test and sample event (zoom-meeting-activity) — align them so the documented sample matches what is actually emitted. (link) (Unresolved)
🔵 The activity_type variable description lists category names (User Join, User Left) that differ from the values the API returns (User joined, User left) — align the wording to avoid confusing operators. (link) (Unresolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

infra-vault-gh-plugin-prod · 2026-07-10T07:32:55Z

💚 Build Succeeded

Buildkite Build
Commit: 1cb3cbc

History

💚 Build #45806 succeeded b2dd6fb
💚 Build #44557 succeeded a9723ef

cc @brijesh-elastic

mergify · 2026-07-10T07:38:20Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

elastic-vault-github-plugin-prod · 2026-07-10T14:57:38Z

Package zoom - 1.26.0 containing this change is available at https://epr.elastic.co/package/zoom/1.26.0/

Add support for the meeting_activity data stream

3efeaed

brijesh-elastic self-assigned this Jun 16, 2026

update changelog entry

a9723ef

brijesh-elastic added 2 commits July 8, 2026 16:39

Merge branch 'main' into zoom-meeting-activity-datastream

0a07a19

implement dashboard and fix & improve CEL code

e17b9ef

brijesh-elastic marked this pull request as ready for review July 8, 2026 14:23

brijesh-elastic requested review from a team as code owners July 8, 2026 14:23

brijesh-elastic added the dashboard Relates to a Kibana dashboard bug, enhancement, or modification. label Jul 8, 2026

vera-review-bot Bot reviewed Jul 8, 2026

View reviewed changes

efd6 reviewed Jul 9, 2026

View reviewed changes

address comments

b2dd6fb

brijesh-elastic requested a review from efd6 July 9, 2026 14:14

vera-review-bot Bot reviewed Jul 9, 2026

View reviewed changes

infra-vault-gh-plugin-prod Bot deleted a comment from elasticmachine Jul 9, 2026

Handle the scenario where next_page_token is empty

1cb3cbc

vera-review-bot Bot reviewed Jul 10, 2026

View reviewed changes

efd6 approved these changes Jul 10, 2026

View reviewed changes

brijesh-elastic merged commit 96400cc into elastic:main Jul 10, 2026
15 checks passed

Navigation Menu

Uh oh!

[zoom] Add support for the meeting activity data stream - #19554

[zoom] Add support for the meeting activity data stream#19554
brijesh-elastic merged 6 commits into
elastic:mainfrom
brijesh-elastic:zoom-meeting-activity-datastream

brijesh-elastic commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026

elastic-vault-github-plugin-prod Bot commented Jun 16, 2026 •

edited

Loading

infra-vault-gh-plugin-prod Bot commented Jul 8, 2026

vera-review-bot Bot Jul 8, 2026

vera-review-bot Bot Jul 8, 2026

vera-review-bot Bot Jul 8, 2026

vera-review-bot Bot Jul 8, 2026

brijesh-elastic Jul 9, 2026

vera-review-bot Bot Jul 8, 2026

brijesh-elastic Jul 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vera-review-bot Bot Jul 9, 2026

efd6 Jul 10, 2026 •

edited

Loading

brijesh-elastic Jul 10, 2026

elastic-vault-github-plugin-prod Bot commented Jul 10, 2026

vera-review-bot Bot Jul 10, 2026

brijesh-elastic Jul 10, 2026

vera-review-bot Bot commented Jul 10, 2026

infra-vault-gh-plugin-prod Bot commented Jul 10, 2026

mergify Bot commented Jul 10, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 10, 2026

Labels

2 participants

Uh oh!

Conversation

brijesh-elastic commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Related issues

github-actions Bot commented Jun 16, 2026

Elastic Docs Style Checker (Vale)

elastic-vault-github-plugin-prod Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

infra-vault-gh-plugin-prod Bot commented Jul 8, 2026

vera-review-bot Bot Jul 8, 2026

Choose a reason for hiding this comment

vera-review-bot Bot Jul 8, 2026

Choose a reason for hiding this comment

vera-review-bot Bot Jul 8, 2026

Choose a reason for hiding this comment

vera-review-bot Bot Jul 8, 2026

Choose a reason for hiding this comment

brijesh-elastic Jul 9, 2026

Choose a reason for hiding this comment

vera-review-bot Bot Jul 8, 2026

Choose a reason for hiding this comment

brijesh-elastic Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vera-review-bot Bot Jul 9, 2026

Choose a reason for hiding this comment

efd6 Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

brijesh-elastic Jul 10, 2026

Choose a reason for hiding this comment

elastic-vault-github-plugin-prod Bot commented Jul 10, 2026

vera-review-bot Bot Jul 10, 2026

Choose a reason for hiding this comment

brijesh-elastic Jul 10, 2026

Choose a reason for hiding this comment

vera-review-bot Bot commented Jul 10, 2026

Review summary

infra-vault-gh-plugin-prod Bot commented Jul 10, 2026

💚 Build Succeeded

History

mergify Bot commented Jul 10, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 10, 2026

Labels

2 participants

brijesh-elastic commented Jun 16, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Jun 16, 2026 •

edited

Loading

efd6 Jul 10, 2026 •

edited

Loading