[qualys_gav] Set lookup index mode on latest asset transform for ES|QL LOOKUP JOIN

[clement-fouque]

Proposed commit message

Configure the latest-asset transform destination with lookup index mode so it can be used as the right-hand side of ES|QL LOOKUP JOIN.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/qualys_gav/changelog.yml	4	Elastic.DirectionalLanguage	Don't use directional language. Use 'the label of the element' instead of 'right-hand side'.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

TL;DR

The qualys_gav check fails because the checked-in rendered README is out of date. PR #20080 changes the README template and the asset sample event, but packages/qualys_gav/docs/README.md was not regenerated.

Remediation

• From packages/qualys_gav, run elastic-package build and commit the regenerated docs/README.md.
• Re-run the qualys_gav package check; it should no longer report checking readme files are up-to-date failed.

Investigation details

Root Cause

packages/qualys_gav/_dev/build/docs/README.md adds the Query-time asset enrichment (LOOKUP JOIN) section after setup, but the rendered packages/qualys_gav/docs/README.md still jumps directly from setup to Logs reference. The PR also updates the asset sample data; the generated README is expected to reflect those changes, while the checked-in rendered README retains the previous volume/whois array shapes and IPv4-mapped IPv6 value.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/45859
• Job/step: Check integrations qualys_gav
• Key log excerpt: Error: checking package failed: checking readme files are up-to-date failed: files do not match
• The CI diff shows generated README differences for volume, whois, and the ::ffff:5102:458e address.

Verification

Not run locally; the diagnosis is based on the failed package-check log and the PR contents.

Follow-up

The Vale directional-language warning in packages/qualys_gav/changelog.yml is separate and is not the cause of this Buildkite failure.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 0cbfb7f

History

• 💔 Build #45859 failed f51d932

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request