[Google Workspace]: suspicious_login events does not pass pipeline (Cannot apply [/] operation to types [java.lang.String] and [java.lang.Integer]) #15520
Description
Integration Name
Google Workspace [google_workspace]
Dataset Name
google_workspace.login
Integration Version
2.41.2
Agent Version
8.15.0
Agent Output Type
elasticsearch
Elasticsearch Version
9.0.3
OS Version and Architecture
Debian / x86_64
Software/API Version
No response
Error Message
Processor 'conditional' with tag '' failed with message 'Cannot apply [/] operation to types [java.lang.String] and [java.lang.Integer].'
Event Original
{
"actor": { "callerType": "KEY", "key": "Google" },
"etag": "\"FQEYJqXpeOV6_3YH8wsi-hSMuqN7BUDbJo9YY4QJAu4/0SzMV-cjLL-Fn96D9A6wOUVq518\"",
"events": {
"name": "suspicious_login",
"parameters": [
{ "name": "affected_email_address", "value": "REDACTED" },
{ "intValue": "1759325583000000", "name": "login_timestamp" }
],
"resourceIds": ["1084964178399"],
"type": "account_warning"
},
"id": { "applicationName": "login", "customerId": "REDACTED", "time": "2025-10-01T13:33:03.000Z", "uniqueQualifier": "-780557281442037232" },
"ipAddress": "REDACTED",
"kind": "admin#reports#activity",
"networkInfo": { "ipAsn": ["REDACTED"], "regionCode": "FR", "subdivisionCode": "FR-NAQ" },
"resourceDetails": [{ "id": "1084964178399", "type": "USER" }]
}
What did you do?
Basic google workspace audit log integration
What did you see?
"script": {
"lang": "painless",
"if": "ctx?.google_workspace?.login?.timestamp != null",
"source": "ctx._temp_ = new HashMap(); ctx._temp_.start = ctx?.google_workspace?.login.timestamp / 1000; "
}
},```
Crashes on every google workspace suspicious login, as it seems that `ctx?.google_workspace?.login.timestamp` is a String.
### What did you expect to see?
No pipeline_error
### Anything else?
_No response_