[Fleet] Rollover datastreams on subobjects mapper exception (elastic#…

…202689)

## Summary

Closes elastic#193044

The previously added `subobjectsFieldChanged` check was not picking up
the subobjects change in this case (okta integration), maybe because it
is in dynamic template mappings. Added an additional condition to pick
up on the `mapper_exception` with subobjects mentioned in the reason.

To verify:
- install okta-2.11.0 integration
- upgrade to okta-2.12.0
- expect upgrade successful, the data stream should be rolled over
```
POST kbn:/api/fleet/epm/packages/okta/2.11.0
{
  "force": true
}

POST logs-okta.system-default/_doc
 {
    "message": "abc",
    "@timestamp": "2024-05-30T07:50:00.000Z"
 }

POST kbn:/api/fleet/epm/packages/okta/2.12.0
{
  "force": true
}

GET logs-okta.system-default/_mapping
```

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.test.ts

@@ -2105,6 +2105,57 @@ describe('EPM template', () => {
         })
       );
     });
+    it('should rollover on mapper exception with subobjects in reason', async () => {
+      const esClient = elasticsearchServiceMock.createElasticsearchClient();
+      esClient.indices.getDataStream.mockResponse({
+        data_streams: [{ name: 'test.prefix1-default' }],
+      } as any);
+      esClient.indices.get.mockResponse({
+        'test.prefix1-default': {
+          mappings: {},
+        },
+      } as any);
+      esClient.indices.simulateTemplate.mockResponse({
+        template: {
+          settings: { index: {} },
+          mappings: {},
+        },
+      } as any);
+      esClient.indices.putMapping.mockImplementation(() => {
+        throw new errors.ResponseError({
+          body: {
+            error: {
+              type: 'mapper_exception',
+              reason:
+                "the [subobjects] parameter can't be updated for the object mapping [okta.debug_context.debug_data]",
+            },
+          },
+        } as any);
+      });
+
+      const logger = loggerMock.create();
+      await updateCurrentWriteIndices(esClient, logger, [
+        {
+          templateName: 'test',
+          indexTemplate: {
+            index_patterns: ['test.*-*'],
+            template: {
+              settings: { index: {} },
+              mappings: {},
+            },
+          } as any,
+        },
+      ]);
+
+      expect(esClient.transport.request).toHaveBeenCalledWith(
+        expect.objectContaining({
+          path: '/test.prefix1-default/_rollover',
+          querystring: {
+            lazy: true,
+          },
+        })
+      );
+    });
     it('should skip rollover on expected error when flag is on', async () => {
       const esClient = elasticsearchServiceMock.createElasticsearchClient();
       esClient.indices.getDataStream.mockResponse({

x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.ts

@@ -1084,6 +1084,10 @@ const updateExistingDataStream = async ({
 
     // if update fails, rollover data stream and bail out
   } catch (err) {
+    subobjectsFieldChanged =
+      subobjectsFieldChanged ||
+      (err.body?.error?.type === 'mapper_exception' &&
+        err.body?.error?.reason?.includes('subobjects'));
     if (
       (isResponseError(err) &&
         err.statusCode === 400 &&