[system] prevent pipeline script error

[leehinman]

What does this PR do?

prevents pipeline script error in system integration

• make sure value isn't null before creating a new HashMap
• add test to verify
• improve error.message

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
  - [ ] If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

How to test this PR locally

elastic-package test pipeline

Related issues

• Closes [system] error.message for java.util.Map.size() because "m" is null #1789

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-10-06T14:58:25.245+0000

• Duration: 14 min 8 sec

• Commit: bc8b58f

Test stats 🧪

Test	Results
Failed	0
Passed	267
Skipped	0
Total	267

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[andrewkroh]

Looks like it needs an elastic-package format.

[2021-10-06T01:31:12.908Z] Error: checking package failed: formatting the integration failed (path: /var/lib/jenkins/workspace/est-manager_integrations_PR-1869/src/github.com/elastic/integrations/packages/system, failFast: true): walking through the integration files failed: formatting file failed (path: /var/lib/jenkins/workspace/est-manager_integrations_PR-1869/src/github.com/elastic/integrations/packages/system/data_stream/security/_dev/test/pipeline/unknown.json): file is not formatted (path: /var/lib/jenkins/workspace/est-manager_integrations_PR-1869/src/github.com/elastic/integrations/packages/system/data_stream/security/_dev/test/pipeline/unknown.json)

[andrewkroh]

Can you confirm whether these changes need applied to the ForwardedEvents pipeline?

[andrewkroh]

I see ForwardedEvents is fixed in a separate PR 👍 .

LGTM