[OpenAI ChatGPT Enterprise][Application Authentication Logs] Add Application Authentication Logs data stream

[muskan-agarwal26]

Proposed commit message

This adds the app_auth_log data stream, associated dashboard and visualizations.

The app_auth_log data stream collects ChatGPT Enterprise application authentication logs from the OpenAI Compliance Logs Platform.

OpenAI ChatGPT Enterprise fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from live data samples, which were subsequently sanitized.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

To test the OpenAI ChatGPT Enterprise package:

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/openai_chatgpt_enterprise directory.
• Run the following command to run tests.

elastic-package test

All tests pass (run against stack 8.19.0):

--- Asset loading ---
dashboard ...b7e6a4c2... is loaded                                     PASS
search ...d2f4a6b8... is loaded                                        PASS
index_template logs-openai_chatgpt_enterprise.app_auth_log is loaded   PASS
ingest_pipeline logs-openai_chatgpt_enterprise.app_auth_log-0.1.0      PASS

--- Pipeline ---
app_auth_log  (ingest pipeline warnings test-app-auth-log.log)         PASS
app_auth_log  test-app-auth-log.log                                    PASS

--- Static ---
app_auth_log  Verify sample_event.json                                 PASS

--- System ---
app_auth_log  default                                                  PASS (38.1s)

Related issues

• Relates: [New Integration] OpenAI Compliance API #19399

Screenshots

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 5 warnings, 1 suggestion found

⚠️ Warnings (5): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/openai_chatgpt_enterprise/_dev/build/docs/README.md	82	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/openai_chatgpt_enterprise/data_stream/app_auth_log/fields/fields.yml	10	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/openai_chatgpt_enterprise/data_stream/app_auth_log/fields/fields.yml	22	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/openai_chatgpt_enterprise/data_stream/app_auth_log/fields/fields.yml	25	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/openai_chatgpt_enterprise/manifest.yml	65	Elastic.DontUse	Don't use 'Please'.

💡 Suggestions (1): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/openai_chatgpt_enterprise/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 39c9abf

History

• 💔 Build #46188 failed 299f23d