Fix cisco amp @metadata._id calculation (elastic#24718) (elastic#24752)

The detection_id wasn't sufficient to uniquely identify documents.

Closes elastic#24717

(cherry picked from commit 82a210a)

Co-authored-by: Lee Hinman <57081003+leehinman@users.noreply.github.com>

CHANGELOG.next.asciidoc

@@ -223,6 +223,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix `google_workspace` pagination. {pull}24668[24668]
 - Fix netflow module ignoring detect_sequence_reset flag. {issue}24268[24268] {pull}24270[24270]
 - Fix Cisco ASA parser for message 302022. {issue}24405[24405] {pull}24697[24697]
+- Fix Cisco AMP `@metadata._id` calculation {issue}24717[24717] {pull}24718[24718]
 - Fix date parsing in GSuite/login and Google Workspace/login filesets. {issue}24694[24694]
 - Fix gcp/vpcflow module error where input type was defaulting to file. {pull}24719[24719]
 

x-pack/filebeat/module/cisco/amp/config/config.yml

@@ -64,16 +64,16 @@ processors:
   - decode_json_fields:
       fields: [message]
       target: json
-  - if:
-      has_fields: ["json.data.detection_id"]
-    then:
-      - fingerprint:
-          fields: ["json.data.detection_id"]
-          target_field: "@metadata._id"
-    else:
-      - fingerprint:
-          fields: ["json.data.timestamp", "json.data.timestamp_nanoseconds", "json.data.event_type_id", "json.data.connector_guid"]
-          target_field: "@metadata._id"
+  - fingerprint:
+      fields:
+        - "json.data.timestamp"
+        - "json.data.timestamp_nanoseconds"
+        - "json.data.event_type_id"
+        - "json.data.connector_guid"
+        - "json.data.id"
+        - "json.data.detection_id"
+      target_field: "@metadata._id"
+      ignore_missing: true
   - add_fields:
       target: ''
       fields: