[apm-data] Set event.dataset if empty for logs

docs/changelog/129074.yaml

@@ -0,0 +1,5 @@
+pr: 129074
+summary: "[apm-data] Set `event.dataset` if empty for logs"
+area: Data streams
+type: bug
+issues: []

x-pack/plugin/apm-data/src/main/resources/ingest-pipelines/logs-apm.app@default-pipeline.yaml

@@ -10,6 +10,12 @@ description: |
   custom pipelines. All built-in processing occurs in the final
   pipelines.
 processors:
+# Set event.dataset if unset to meet Anomaly Detection requirements
+- set:
+    if: "ctx.data_stream?.dataset != null"
+    field: event.dataset
+    value: "{{{data_stream.dataset}}}"
+    override: false
 # Invoke user-defined custom pipelines, in ascending order of specificity:
 - pipeline:
     name: global@custom

x-pack/plugin/apm-data/src/main/resources/ingest-pipelines/logs-apm.error@default-pipeline.yaml

@@ -10,6 +10,12 @@ description: |
   custom pipelines. All built-in processing occurs in the final
   pipelines.
 processors:
+# Set event.dataset if unset to meet Anomaly Detection requirements
+- set:
+    if: "ctx.data_stream?.dataset != null"
+    field: event.dataset
+    value: "{{{data_stream.dataset}}}"
+    override: false
 # Invoke user-defined custom pipelines, in ascending order of specificity:
 - pipeline:
     name: global@custom

x-pack/plugin/apm-data/src/main/resources/resources.yaml

@@ -1,7 +1,7 @@
 # "version" holds the version of the templates and ingest pipelines installed
 # by xpack-plugin apm-data. This must be increased whenever an existing template or
 # pipeline is changed, in order for it to be updated on Elasticsearch upgrade.
-version: 13
+version: 14
 
 component-templates:
   # Data lifecycle.