[Fleet] Use a date processor instead of a script and set (#136678)

x-pack/plugins/fleet/server/constants/fleet_es_assets.ts

@@ -77,7 +77,7 @@ export const FLEET_COMPONENT_TEMPLATES = [
   },
 ];
 
-export const FLEET_FINAL_PIPELINE_VERSION = 2;
+export const FLEET_FINAL_PIPELINE_VERSION = 3;
 
 // If the content is updated you probably need to update the FLEET_FINAL_PIPELINE_VERSION too to allow upgrade of the pipeline
 export const FLEET_FINAL_PIPELINE_CONTENT = `---
@@ -88,14 +88,14 @@ _meta:
 description: >
   Final pipeline for processing all incoming Fleet Agent documents.
 processors:
-  - set:
-      description: Add time when event was ingested.
-      field: event.ingested
-      copy_from: _ingest.timestamp
-  - script:
-      description: Remove sub-seconds from event.ingested to improve storage efficiency.
+  - date:
+      description: Add time when event was ingested (and remove sub-seconds to improve storage efficiency)
       tag: truncate-subseconds-event-ingested
-      source: ctx.event.ingested = ctx.event.ingested.withNano(0).format(DateTimeFormatter.ISO_OFFSET_DATE_TIME);
+      field: _ingest.timestamp
+      target_field: event.ingested
+      formats:
+        - ISO8601
+      output_format: date_time_no_millis
       ignore_failure: true
   - remove:
       description: Remove any pre-existing untrusted values.

x-pack/test/fleet_api_integration/apis/epm/final_pipeline.ts

@@ -101,7 +101,7 @@ export default function (providerContext: FtrProviderContext) {
       await supertest.post(`/api/fleet/setup`).set('kbn-xsrf', 'xxxx');
       const pipelineRes = await es.ingest.getPipeline({ id: FINAL_PIPELINE_ID });
       expect(pipelineRes).to.have.property(FINAL_PIPELINE_ID);
-      expect(pipelineRes[FINAL_PIPELINE_ID].version).to.be(2);
+      expect(pipelineRes[FINAL_PIPELINE_ID].version).to.be(3);
     });
 
     it('should correctly setup the final pipeline and apply to fleet managed index template', async () => {