fix: address Copilot review feedback on elasticsearch9 returner

- Fix event_return() to index each event inside the loop instead of only
  the last one; empty events list no longer crashes
- Normalize ret['data'] into ret['return'] when return is None so the
  payload sent to Elasticsearch contains the actual data
- Fix typos in __virtual__ error messages and debug log string
- Add skipif marker for ES9-specific __virtual__ test
- Add tests for multiple events and empty events list

Author: cesan3

src/saltext/elasticsearch/returners/elasticsearch9_mod.py

@@ -129,10 +129,10 @@ def __virtual__():
     if not HAS_ELASTICSEARCH:
         return (
             False,
-            "Cannot load module elasticsearch: elasticsearch librarielastic not found",
+            "Cannot load module elasticsearch: elasticsearch library not found",
         )
     if ES_MAJOR_VERSION < 9:
-        return (False, "Cannot load the module, elasticserach version is not 9+")
+        return (False, "Cannot load the module, elasticsearch version is not 9+")
 
     return __virtualname__
 
@@ -247,6 +247,11 @@ def returner(ret):
         )
         return
 
+    # If there is data but no explicit return value, normalize it so that
+    # downstream logic that expects ret["return"] still sees the payload.
+    if ret.get("return") is None and ret.get("data") is not None:
+        ret["return"] = ret["data"]
+
     # Build the index name
     if options["states_single_index"] and job_fun in STATE_FUNCTIONS:
         index = f"salt-{STATE_FUNCTIONS[job_fun]}"
@@ -334,7 +339,7 @@ def dst(self, _dt):
     }
 
     if options["debug_returner_payload"]:
-        log.debug("elasicsearch payload: %s", data)
+        log.debug("elasticsearch payload: %s", data)
 
     # Post the payload
     ret = __salt__["elasticsearch.document_create"](
@@ -360,11 +365,11 @@ def event_return(events):
     for event in events:
         data = {"tag": event.get("tag", ""), "data": event.get("data", "")}
 
-    __salt__["elasticsearch.document_create"](
-        index=index,
-        id_=uuid.uuid4(),
-        document=salt.utils.json.dumps(data),
-    )
+        __salt__["elasticsearch.document_create"](
+            index=index,
+            id_=uuid.uuid4(),
+            document=salt.utils.json.dumps(data),
+        )
 
 
 def prep_jid(nocache=False, passed_jid=None):  # pylint: disable=unused-argument

tests/unit/returners/test_elasticsearch.py

@@ -95,6 +95,7 @@ def test__virtual_without_elasticsearch():
         assert "elasticsearch" in result[1].lower()
 
 
+@pytest.mark.skipif(ES_MAJOR_VERSION < 9, reason="ES9-specific __virtual__ behavior")
 def test__virtual_with_old_version():
     """
     Test __virtual__ returns False when ES_MAJOR_VERSION < 9.
@@ -272,7 +273,8 @@ def test_returner_no_data_no_return(mock_salt, default_options):
 
 def test_returner_with_data_field(mock_salt, default_options):
     """
-    data is not None, should proceed even if return is None.
+    data is not None, should proceed even if return is None, and data should
+    be normalized into ret['return'] so the payload contains it.
     """
     ret = {
         "fun": "test.ping",
@@ -289,6 +291,9 @@ def test_returner_with_data_field(mock_salt, default_options):
     ):
         elasticsearch_return.returner(ret)
         mock_salt["elasticsearch.document_create"].assert_called_once()
+        kwargs = mock_salt["elasticsearch.document_create"].call_args[1]
+        doc = salt.utils.json.loads(kwargs["document"])
+        assert doc["data"] == {"some": "data"}
 
 
 def test_returner_index_date(mock_salt, default_options, sample_ret):
@@ -536,6 +541,37 @@ def test_event_return(mock_salt, default_options):
         assert kwargs["index"] == "salt-master-event-cache"
 
 
+def test_event_return_multiple_events(mock_salt, default_options):
+    """
+    Multiple events should each produce a document_create call.
+    """
+    events = [
+        {"tag": "salt/job/1/ret/minion1", "data": {"return": True}},
+        {"tag": "salt/job/2/ret/minion2", "data": {"return": False}},
+        {"tag": "salt/job/3/ret/minion3", "data": {"return": "ok"}},
+    ]
+    with (
+        patch.dict(elasticsearch_return.__salt__, mock_salt),
+        patch.dict(elasticsearch_return.__opts__, {}),
+        patch("salt.returners.get_returner_options", return_value=default_options),
+    ):
+        elasticsearch_return.event_return(events)
+        assert mock_salt["elasticsearch.document_create"].call_count == 3
+
+
+def test_event_return_empty(mock_salt, default_options):
+    """
+    Empty events list should not call document_create and should not crash.
+    """
+    with (
+        patch.dict(elasticsearch_return.__salt__, mock_salt),
+        patch.dict(elasticsearch_return.__opts__, {}),
+        patch("salt.returners.get_returner_options", return_value=default_options),
+    ):
+        elasticsearch_return.event_return([])
+        mock_salt["elasticsearch.document_create"].assert_not_called()
+
+
 def test_event_return_with_index_date(mock_salt, default_options):
     """
     index_date=True appends date to event index.