o365: Ignore failures in rename processors for organization fields

packages/o365/changelog.yml

@@ -1,4 +1,11 @@
 # newer versions go on top
+- version: "2.16.1"
+  changes:
+    - description: |
+        Ignore failures in rename process for organization fields to avoid collision with Agentless organization field.
+        This is a temporary workaround until https://github.com/elastic/kibana/issues/221312 is addressed.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/13983
 - version: "2.16.0"
   changes:
     - description: Populate `message` field from the O365 Audit Log `Name` field instead of `Comments` in SecurityComplianceAlerts events to better reflect Alert Titles.

packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

@@ -85,6 +85,7 @@ processors:
       field: o365audit.OrganizationId
       target_field: organization.id
       ignore_missing: true
+      ignore_failure: true
 
   - json:
       tag: json-extract-stringly-AdditionalInfo
@@ -361,6 +362,7 @@ processors:
       field: o365audit.OrganizationName
       target_field: organization.name
       ignore_missing: true
+      ignore_failure: true
       if: ctx.event?.code == "ExchangeAdmin"
   - rename:
       field: o365audit.OriginatingServer
@@ -388,6 +390,7 @@ processors:
       field: o365audit.OrganizationName
       target_field: organization.name
       ignore_missing: true
+      ignore_failure: true
       if: ctx.event?.code == "ExchangeItem"
   - rename:
       field: o365audit.OriginatingServer
@@ -1092,6 +1095,7 @@ processors:
   - lowercase:
       field: organization.id
       ignore_missing: true
+      ignore_failure: true
   - set:
       field: host.id
       copy_from: organization.id

packages/o365/manifest.yml

@@ -1,6 +1,6 @@
 name: o365
 title: Microsoft Office 365
-version: "2.16.0"
+version: "2.16.1"
 description: Collect logs from Microsoft Office 365 with Elastic Agent.
 type: integration
 format_version: "3.2.3"