[filebeat] Fix Cisco AMP rate limit and pagination. (#32030) (#32302)

* Fix Cisco AMP rate limit and pagination.

* Add pr number

* Fix RateLimit header names

* Update CHANGELOG.next.asciidoc

(cherry picked from commit ad685e7)

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

CHANGELOG.next.asciidoc

@@ -41,6 +41,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 
 *Filebeat*
 
+- Fix Cisco AMP rate limit and pagination. {pull}32030[32030]
 - Fix wrong state ID in states registry for awss3 s3 direct input. {pull}32164[32164]
 - cisco/asa: fix handling of user names when there are Security Group Tags present. {issue}32009[32009] {pull}32196[32196]
 

x-pack/filebeat/module/cisco/amp/config/config.yml

@@ -27,9 +27,10 @@ request.transforms:
 - set:
     target: url.params.limit
     value: {{ .limit }}
-request.rate_limit.limit: '[[ .last_response.header.Get "X-RateLimit-Limit" ]]'
-request.rate_limit.reset: '[[ .last_response.header.Get "X-RateLimit-Reset" ]]'
-request.rate_limit.remaining: '[[ .last_response.header.Get "X-RateLimit-Remaining" ]]'
+request.rate_limit.limit: '[[ .last_response.header.Get "X-Rate-Limit-Limit" ]]'
+request.rate_limit.early_limit: 1
+request.rate_limit.reset: '[[ add (toInt (.last_response.header.Get "X-Rate-Limit-Reset")) ((now).Unix) ]]'
+request.rate_limit.remaining: '[[ .last_response.header.Get "X-Rate-Limit-Remaining" ]]'
 
 response.split:
   target: body.data
@@ -39,6 +40,7 @@ response.pagination:
 - set:
     target: url.value
     value: '[[ .last_response.body.metadata.links.next ]]'
+    fail_on_template_error: true
 
 cursor:
   timestamp: