remove reference to .fleet_final_pipeline-1

- configure global@custom ingest pipeline to run  .fleet_final_pipeline-1 when available (heavynodes do not have this pipeline).
  - Update global@custom pipeline to remove error message related to sending EA logs through logstash (https://github.com/elastic/kibana/issues/183959)

salt/elasticsearch/defaults.yaml

@@ -691,7 +691,6 @@ elasticsearch:
                 match_mapping_type: string
           settings:
             index:
-              final_pipeline: .fleet_final_pipeline-1
               lifecycle:
                 name: so-import-logs
               mapping:

salt/elasticsearch/files/ingest/global@custom

@@ -177,6 +177,19 @@
                 "description": "Extract IPs from Elastic Agent events (host.ip) and adds them to related.ip"
             }
         },
+        {
+            "pipeline": {
+                "name": ".fleet_final_pipeline-1",
+                "ignore_missing_pipeline": true
+            }
+        },
+        {
+            "remove": {
+                "field": "event.agent_id_status",
+                "ignore_missing": true,
+                "if": "ctx?.event?.agent_id_status == 'auth_metadata_missing'"
+            }
+        },
         {
             "remove": {
                 "field": [

salt/elasticsearch/templates/component/elastic-agent/so-fleet_agent_id_verification-1.json

@@ -2,7 +2,7 @@
   "template": {
     "settings": {
       "index": {
-        "final_pipeline": ".fleet_final_pipeline-1"
+        "final_pipeline": "global@custom"
       }
     },
     "mappings": {