o365: fix handling of error conditions when requesting work continuation (#15380)

CEL type(o.f) == T does not work the same way as painless o.f instanceof T
if f is not in o. It is necessary to check for existence first.

In this case, this can be done either by directly checking for the existence
of events in state, or because of an invariant in the program, by the absence
of error in state. The latter is chosen for clarity and to ensure that the
invariant is kept.

Author: efd6

packages/o365/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.29.1"
+  changes:
+    - description: Fix handling of error conditions when requesting work continuation.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/15380
 - version: "2.29.0"
   changes:
     - description: Tolerate undocumented API changes in request parameter syntax.

packages/o365/data_stream/audit/agent/stream/cel.yml.hbs

@@ -483,7 +483,10 @@ program: |-
   ).as(state,
     // Make sure we complete the remaining work if we got
     // no events but the work lists are not empty.
-    (state.want_more && type(state.events) == list && size(state.events) == 0) ?
+    // We do not need to put a dummy event in in the
+    // case that we have errored, since the error will
+    // be raised to an event by the input.
+    (state.want_more && !has(state.error) && type(state.events) == list && size(state.events) == 0) ?
       state.with(
         {
           "events": [{"retry": true}],

packages/o365/manifest.yml

@@ -1,6 +1,6 @@
 name: o365
 title: Microsoft Office 365
-version: "2.29.0"
+version: "2.29.1"
 description: Collect logs from Microsoft Office 365 with Elastic Agent.
 type: integration
 format_version: "3.2.3"