[integrations] - Fixed aggregation error in AWS Guard Duty Severity Overview Dashboard

[ShourieG]

Type of change

Please label this PR with one of the following labels, depending on the scope of your change:

• Bug

Proposed commit message

The Severity Overview Dashboard had a bug where the Severity Over Time Logs Visualisation was aggregating on the "_id" field. Since this is meta field it cannot be aggregated on. This has been fixed to count the number of records, which is a default feature.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[kcreddy]

LGTM

[elasticmachine]

🚀 Benchmarks report

Package aws 👍(11) 💚(3) 💔(3)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
route53_public_logs	12658.23	7692.31	-4965.92 (-39.23%)	💔
ec2_logs	37037.04	27777.78	-9259.26 (-25%)	💔
guardduty	1005.03	711.74	-293.29 (-29.18%)	💔

To see the full report comment with /test benchmark fullreport

[elasticmachine]

�� Build Succeeded

• Buildkite Build
• Commit: bb940b4

cc @ShourieG

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[elasticmachine]

Package aws - 2.12.2 containing this change is available at https://epr.elastic.co/search?package=aws

[louisong]

@ShourieG Customer is asking if it is possible for the bug fix to be backported to older version 8.10 or 8.11?
They are trying to avoid upgrading the entire stack to 8.12 for testing out the fix.

[ShourieG]

@ShourieG Customer is asking if it is possible for the bug fix to be backported to older version 8.10 or 8.11? They are trying to avoid upgrading the entire stack to 8.12 for testing out the fix.

@louisong Unfortunately this cannot be backported as integration rollouts are tied to specific Kibana versions unlike beats. Previous updates already bumped up the version to 8.12 so this PR is built on top of that. The customer could update to the latest 8.12 or manually clone the dashboard and replace the unique count function with a record count function in Kibana Lens, which is pretty simple to do.