[google_workspace] Add support for Gmail events

[navnit-elastic]

Proposed commit message

google_workspace: add support for Gmail event type as a new data stream

This adds support for the Gmail logs as a new data stream to enhance
the overall visibility of data in the Google Workspace integration.

This changes includes updating navigation links in to the relevant dashboards.

Sanitized test case inputs were obtained from a live Google Workspace instance
using the BigQuery API[1]. The schema for Gmail logs can be found in the
documentation[2].

[1] https://cloud.google.com/bigquery/docs/reference/rest/v2/jobs
[2] https://support.google.com/a/answer/12384955

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

How to test this PR locally

Pipeline Test:

--- Test results for package: google_workspace - START ---
╭──────────────────┬─────────────┬───────────┬───────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE          │ DATA STREAM │ TEST TYPE │ TEST NAME                                 │ RESULT │ TIME ELAPSED │
├──────────────────┼─────────────┼───────────┼───────────────────────────────────────────┼────────┼──────────────┤
│ google_workspace │ gmail       │ pipeline  │ (ingest pipeline warnings test-gmail.log) │ PASS   │ 394.314923ms │
│ google_workspace │ gmail       │ pipeline  │ test-gmail.log                            │ PASS   │ 272.136463ms │
╰──────────────────┴─────────────┴───────────┴───────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: google_workspace - END   ---
Done

System Tests:

--- Test results for package: google_workspace - START ---
╭──────────────────┬─────────────┬───────────┬───────────┬────────┬───────────────╮
│ PACKAGE          │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │  TIME ELAPSED │
├──────────────────┼─────────────┼───────────┼───────────┼────────┼───────────────┤
│ google_workspace │ gmail       │ system    │ default   │ PASS   │ 40.551859829s │
╰──────────────────┴─────────────┴───────────┴───────────┴────────┴───────────────╯
--- Test results for package: google_workspace - END   ---
Done

Related issues

• Closes [Google Workspace]: Add support for Gmail event type #14377

Screenshots

Dashboard:

Integration Configuration:

Documentation:

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[andrewkroh]

Both fields here should use external: ecs. https://github.com/elastic/integrations/wiki/Fleet-Package-Code-Review-Comments#defining-an-ecs-field-without-using-an-external-definition

[andrewkroh]

Use external: ecs for all ECS fields to ensure consistency.

Suggested change

	- name: data_stream.type
	type: constant_keyword
	description: Data stream type.
	- name: data_stream.dataset
	type: constant_keyword
	description: Data stream dataset.
	- name: data_stream.namespace
	type: constant_keyword
	description: Data stream namespace.
	- name: event.module
	type: constant_keyword
	description: Event module.
	value: google_workspace
	- name: event.dataset
	type: constant_keyword
	description: Event dataset.
	value: google_workspace.gmail
	- name: '@timestamp'
	type: date
	description: Event timestamp.
	- name: data_stream.type
	external: ecs
	- name: data_stream.dataset
	external: ecs
	- name: data_stream.namespace
	external: ecs
	- name: event.module
	type: constant_keyword
	external: ecs
	value: google_workspace
	- name: event.dataset
	type: constant_keyword
	external: ecs
	value: google_workspace.gmail
	- name: "@timestamp"
	external: ecs

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 7a19c54

History

• 💔 Build #29288 failed 6d75e24
• 💚 Build #28696 succeeded 7415bb0
• 💔 Build #28631 failed 6c0c6a6
• 💔 Build #28630 failed 94caef8
• 💚 Build #28427 succeeded 71c446e
• 💔 Build #28426 failed 91fccc6

cc @navnit-elastic

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
94.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube