x-pack/filebeat/input/entityanalytics/provider/azuread: fix configuration ordering

[efd6]

Proposed commit message

Previously, the configuration was eager, this caused a panic when the request trace logging option was turned on since it was started without a context.

Move the construction of components to when we have all the parts we need.

---

Tested locally by building at this commit and injecting the agentbeat into a running ep stack with request trace logging enabled. Outputs this to the trace log:

{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.840Z","message":"HTTP request","transaction.id":"B0PCS4IRTNL1E-1","url.original":"http://svc-entra_id:8080/v1.0/users/delta?%24select=accountEnabled%2CuserPrincipalName%2Cmail%2CdisplayName%2CgivenName%2Csurname%2CjobTitle%2CofficeLocation%2CmobilePhone%2CbusinessPhones","url.scheme":"http","url.path":"/v1.0/users/delta","url.domain":"svc-entra_id","url.port":"8080","url.query":"%24select=accountEnabled%2CuserPrincipalName%2Cmail%2CdisplayName%2CgivenName%2Csurname%2CjobTitle%2CofficeLocation%2CmobilePhone%2CbusinessPhones","http.request.method":"GET","user_agent.original":"","http.request.body.content":"","http.request.body.truncated":false,"http.request.body.bytes":0,"http.request.mime_type":"","event.original":"GET /v1.0/users/delta?%24select=accountEnabled%2CuserPrincipalName%2Cmail%2CdisplayName%2CgivenName%2Csurname%2CjobTitle%2CofficeLocation%2CmobilePhone%2CbusinessPhones HTTP/1.1\r\nHost: svc-entra_id:8080\r\nUser-Agent: Go-http-client/1.1\r\nAuthorization: Bearer TEST\r\nAccept-Encoding: gzip\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.842Z","message":"HTTP response","transaction.id":"B0PCS4IRTNL1E-1","http.response.status_code":200,"http.response.body.content":"","http.response.body.truncated":true,"http.response.body.bytes":855,"http.response.mime_type":"text/plain; charset=utf-8","event.original":"HTTP/1.1 200 OK\r\nContent-Length: 855\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Mon, 12 Aug 2024 08:19:42 GMT\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.842Z","message":"HTTP request","transaction.id":"B0PCS4IRTNL1E-2","url.original":"http://svc-entra_id:8080/v1.0/devices/delta?%24select=accountEnabled%2CdeviceId%2CdisplayName%2CoperatingSystem%2CoperatingSystemVersion%2CphysicalIds%2CextensionAttributes%2CalternativeSecurityIds","url.scheme":"http","url.path":"/v1.0/devices/delta","url.domain":"svc-entra_id","url.port":"8080","url.query":"%24select=accountEnabled%2CdeviceId%2CdisplayName%2CoperatingSystem%2CoperatingSystemVersion%2CphysicalIds%2CextensionAttributes%2CalternativeSecurityIds","http.request.method":"GET","user_agent.original":"","http.request.body.content":"","http.request.body.truncated":false,"http.request.body.bytes":0,"http.request.mime_type":"","event.original":"GET /v1.0/devices/delta?%24select=accountEnabled%2CdeviceId%2CdisplayName%2CoperatingSystem%2CoperatingSystemVersion%2CphysicalIds%2CextensionAttributes%2CalternativeSecurityIds HTTP/1.1\r\nHost: svc-entra_id:8080\r\nUser-Agent: Go-http-client/1.1\r\nAuthorization: Bearer TEST\r\nAccept-Encoding: gzip\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.843Z","message":"HTTP response","transaction.id":"B0PCS4IRTNL1E-2","http.response.status_code":200,"http.response.body.content":"","http.response.body.truncated":true,"http.response.body.bytes":422,"http.response.mime_type":"text/plain; charset=utf-8","event.original":"HTTP/1.1 200 OK\r\nContent-Length: 422\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Mon, 12 Aug 2024 08:19:42 GMT\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.843Z","message":"HTTP request","transaction.id":"B0PCS4IRTNL1E-3","url.original":"http://svc-entra_id:8080/v1.0/devices//c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredOwners","url.scheme":"http","url.path":"/v1.0/devices//c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredOwners","url.domain":"svc-entra_id","url.port":"8080","url.query":"","http.request.method":"GET","user_agent.original":"","http.request.body.content":"","http.request.body.truncated":false,"http.request.body.bytes":0,"http.request.mime_type":"","event.original":"GET /v1.0/devices//c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredOwners HTTP/1.1\r\nHost: svc-entra_id:8080\r\nUser-Agent: Go-http-client/1.1\r\nAuthorization: Bearer TEST\r\nAccept-Encoding: gzip\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.843Z","message":"HTTP response","transaction.id":"B0PCS4IRTNL1E-3","http.response.status_code":301,"http.response.body.content":"","http.response.body.truncated":false,"http.response.body.bytes":0,"http.response.mime_type":"","event.original":"HTTP/1.1 301 Moved Permanently\r\nDate: Mon, 12 Aug 2024 08:19:42 GMT\r\nLocation: /v1.0/devices/c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredOwners\r\nContent-Length: 0\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.843Z","message":"HTTP request","transaction.id":"B0PCS4IRTNL1E-4","url.original":"http://svc-entra_id:8080/v1.0/devices/c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredOwners","url.scheme":"http","url.path":"/v1.0/devices/c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredOwners","url.domain":"svc-entra_id","url.port":"8080","url.query":"","http.request.method":"GET","user_agent.original":"","http.request.body.content":"","http.request.body.truncated":false,"http.request.body.bytes":0,"http.request.mime_type":"","event.original":"GET /v1.0/devices/c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredOwners HTTP/1.1\r\nHost: svc-entra_id:8080\r\nUser-Agent: Go-http-client/1.1\r\nAuthorization: Bearer TEST\r\nReferer: http://svc-entra_id:8080/v1.0/devices//c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredOwners\r\nAccept-Encoding: gzip\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.844Z","message":"HTTP response","transaction.id":"B0PCS4IRTNL1E-4","http.response.status_code":404,"http.response.body.content":"","http.response.body.truncated":false,"http.response.body.bytes":0,"http.response.mime_type":"","event.original":"HTTP/1.1 404 Not Found\r\nDate: Mon, 12 Aug 2024 08:19:42 GMT\r\nContent-Length: 0\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.844Z","message":"HTTP request","transaction.id":"B0PCS4IRTNL1E-5","url.original":"http://svc-entra_id:8080/v1.0/devices//c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredUsers","url.scheme":"http","url.path":"/v1.0/devices//c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredUsers","url.domain":"svc-entra_id","url.port":"8080","url.query":"","http.request.method":"GET","user_agent.original":"","http.request.body.content":"","http.request.body.truncated":false,"http.request.body.bytes":0,"http.request.mime_type":"","event.original":"GET /v1.0/devices//c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredUsers HTTP/1.1\r\nHost: svc-entra_id:8080\r\nUser-Agent: Go-http-client/1.1\r\nAuthorization: Bearer TEST\r\nAccept-Encoding: gzip\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.844Z","message":"HTTP response","transaction.id":"B0PCS4IRTNL1E-5","http.response.status_code":301,"http.response.body.content":"","http.response.body.truncated":false,"http.response.body.bytes":0,"http.response.mime_type":"","event.original":"HTTP/1.1 301 Moved Permanently\r\nDate: Mon, 12 Aug 2024 08:19:42 GMT\r\nLocation: /v1.0/devices/c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredUsers\r\nContent-Length: 0\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.844Z","message":"HTTP request","transaction.id":"B0PCS4IRTNL1E-6","url.original":"http://svc-entra_id:8080/v1.0/devices/c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredUsers","url.scheme":"http","url.path":"/v1.0/devices/c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredUsers","url.domain":"svc-entra_id","url.port":"8080","url.query":"","http.request.method":"GET","user_agent.original":"","http.request.body.content":"","http.request.body.truncated":false,"http.request.body.bytes":0,"http.request.mime_type":"","event.original":"GET /v1.0/devices/c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredUsers HTTP/1.1\r\nHost: svc-entra_id:8080\r\nUser-Agent: Go-http-client/1.1\r\nAuthorization: Bearer TEST\r\nReferer: http://svc-entra_id:8080/v1.0/devices//c9d9f9b3-0c91-4080-b392-78f775903b3a/registeredUsers\r\nAccept-Encoding: gzip\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.845Z","message":"HTTP response","transaction.id":"B0PCS4IRTNL1E-6","http.response.status_code":404,"http.response.body.content":"","http.response.body.truncated":false,"http.response.body.bytes":0,"http.response.mime_type":"","event.original":"HTTP/1.1 404 Not Found\r\nDate: Mon, 12 Aug 2024 08:19:42 GMT\r\nContent-Length: 0\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.845Z","message":"HTTP request","transaction.id":"B0PCS4IRTNL1E-7","url.original":"http://svc-entra_id:8080/v1.0/groups/delta?%24select=displayName%2Cmembers","url.scheme":"http","url.path":"/v1.0/groups/delta","url.domain":"svc-entra_id","url.port":"8080","url.query":"%24select=displayName%2Cmembers","http.request.method":"GET","user_agent.original":"","http.request.body.content":"","http.request.body.truncated":false,"http.request.body.bytes":0,"http.request.mime_type":"","event.original":"GET /v1.0/groups/delta?%24select=displayName%2Cmembers HTTP/1.1\r\nHost: svc-entra_id:8080\r\nUser-Agent: Go-http-client/1.1\r\nAuthorization: Bearer TEST\r\nAccept-Encoding: gzip\r\n\r\n","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-08-12T08:19:42.845Z","message":"HTTP response","transaction.id":"B0PCS4IRTNL1E-7","http.response.status_code":200,"http.response.body.content":"","http.response.body.truncated":true,"http.response.body.bytes":485,"http.response.mime_type":"text/plain; charset=utf-8","event.original":"HTTP/1.1 200 OK\r\nContent-Length: 485\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Mon, 12 Aug 2024 08:19:42 GMT\r\n\r\n","ecs.version":"1.6.0"}

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• For entityanalytics_{okta,entra_id} - Add request tracer config option for 8.15 integrations#10498

Use cases

Screenshots

Logs

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)