What does this PR do?

What

Replace the foreach + set processors combo with a single script processor in the ingest pipeline for Azure AD sign-in logs.

Why

The set processor expands the dots contained in the field name into subfields.

Sometimes attributes contained in authentication_processing_details have dots, for example:

# source
{"key": "a.b.c", "value": true}

In such cases, the set processor would turn it into:

# this is a side-effect
{
  "a": {
    "b": {
      "c": true
    }
  }
}

Instead of:

# this is the expected result
{"a.b.c": True}

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Relates [Filebeat] Azure Signin Module authentication_processing_details Issue beats#34330

Screenshots