[Serverless security] [claude_code] Failing test daily: policy test: test-default.yml in claude_code.events

[elastic-vault-github-plugin-prod]

• Serverless: security
• Package: claude_code
• Failing test: policy test: test-default.yml
• DataStream: events
• Owners:
  • @elastic/security-service-integrations
  • @elastic/sit-crest-contractors

Error:

unexpected content in policy: --- want
+++ got
@@ -1,3 +1,3 @@
 connectors:
-    forward: {}
+    forward/componentid-0: {}
 exporters:
@@ -27,4 +27,4 @@
                 - set(attributes["data_stream.type"], "logs")
-                - set(attributes["data_stream.dataset"], "claude_code.events")
-                - set(attributes["data_stream.namespace"], "ep")
+                - set(attributes["data_stream.dataset"], "claude_code.events") where attributes["data_stream.dataset"] == nil
+                - set(attributes["data_stream.namespace"], "ep") where attributes["data_stream.namespace"] == nil
 receivers:
@@ -37,3 +37,3 @@
     pipelines:
-        logs:
+        logs/componentid-0:
             exporters:
@@ -41,6 +41,6 @@
             receivers:
-                - forward
-        logs/componentid-0:
+                - forward/componentid-0
+        logs/componentid-1:
             exporters:
-                - forward
+                - forward/componentid-0
            

First build failed: https://buildkite.com/elastic/integrations-serverless/builds/1967