[OpenAI ChatGPT Enterprise][Audit Logs] Add audit_log data stream

[muskan-agarwal26]

Proposed commit message

The initial release includes audit_log data stream, associated dashboard and visualizations.

OpenAI ChatGPT Enterprise fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from live data samples, which were subsequently sanitized.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

To test the OpenAI ChatGPT Enterprise package:

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/openai_chatgpt_enterprise directory.
• Run the following command to run tests.

elastic-package test

--- Test results for package: openai_chatgpt_enterprise ---

PACKAGE                    DATA STREAM  TEST TYPE  TEST NAME                                       RESULT  TIME ELAPSED
openai_chatgpt_enterprise  audit_log    pipeline   (ingest pipeline warnings test-audit-log.log)   PASS    408.526628ms
openai_chatgpt_enterprise  audit_log    pipeline   test-audit-log.log                              PASS    390.370259ms
openai_chatgpt_enterprise  audit_log    static     Verify sample_event.json                        PASS    187.94093ms
openai_chatgpt_enterprise  audit_log    system     default                                         PASS    53.042102346s

Related issues

• Relates: [New Integration] OpenAI ChatGPT Enterprise [New Integration] OpenAI Compliance API #19399

Screenshots

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 4 warnings, 3 suggestions found

⚠️ Warnings (4): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/fields.yml	212	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/fields.yml	383	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/fields.yml	401	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/openai_chatgpt_enterprise/manifest.yml	64	Elastic.DontUse	Don't use 'Please'.

💡 Suggestions (3): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/openai_chatgpt_enterprise/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/fields.yml	113	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/openai_chatgpt_enterprise/data_stream/audit_log/fields/fields.yml	431	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: 88165a3

Failed CI Steps

• Check integrations openai_chatgpt_enterprise

History