[Metricbeat] Align rabbitmq with ECS and have module fields (#10563)

CHANGELOG.next.asciidoc

@@ -124,6 +124,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Update a few elasticsearch.* fields to map to ECS. {pull}10350[10350]
 - Update a few logstash.* fields to map to ECS. {pull}10350[10350]
 - Update a few kibana.* fields to map to ECS. {pull}10350[10350]
+- Update rabbitmq.* fields to map to ECS. {pull}10563[10563]
 - Update haproxy.* fields to map to ECS. {pull}10558[10558] {pull}10568[10568]
 
 *Packetbeat*

dev-tools/ecs-migration.yml

@@ -1678,6 +1678,44 @@
   alias: true
   beat: metricbeat
 
+### Rabbitmq
+
+- from: rabbitmq.connection.node
+  to: rabbitmq.node.name
+  alias: true
+  beat: metricbeat
+
+- from: rabbitmq.connection.vhost
+  to: rabbitmq.vhost
+  alias: true
+  beat: metricbeat
+
+- from: rabbitmq.connection.user
+  to: user.name
+  alias: true
+  beat: metricbeat
+
+- from: rabbitmq.exchange.vhost
+  to: rabbitmq.vhost
+  alias: true
+  beat: metricbeat
+
+- from: rabbitmq.exchange.user
+  to: user.name
+  alias: true
+  beat: metricbeat
+
+- from: rabbitmq.queue.node
+  to: rabbitmq.node.name
+  alias: true
+  beat: metricbeat
+
+- from: rabbitmq.queue.vhost
+  to: rabbitmq.vhost
+  alias: true
+  beat: metricbeat
+
+
 ### Redis
 
 - from: php_fpm.status.pid

metricbeat/docs/fields.asciidoc

@@ -19831,6 +19831,26 @@ RabbitMQ module
 
 
 
+*`rabbitmq.node.name`*::
++
+--
+type: keyword
+
+Node name
+
+
+--
+
+*`rabbitmq.vhost`*::
++
+--
+type: keyword
+
+Virtual host name with non-ASCII characters escaped as in C.
+
+
+--
+
 [float]
 == connection fields
 
@@ -19841,7 +19861,9 @@ connection
 *`rabbitmq.connection.name`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: rabbitmq.name
 
 The name of the connection with non-ASCII characters escaped as in C.
 
@@ -19851,7 +19873,9 @@ The name of the connection with non-ASCII characters escaped as in C.
 *`rabbitmq.connection.vhost`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: rabbitmq.vhost
 
 Virtual host name with non-ASCII characters escaped as in C.
 
@@ -19861,7 +19885,9 @@ Virtual host name with non-ASCII characters escaped as in C.
 *`rabbitmq.connection.user`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: user.name
 
 User name.
 
@@ -19871,7 +19897,9 @@ User name.
 *`rabbitmq.connection.node`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: rabbitmq.node.name
 
 Node name.
 
@@ -20030,7 +20058,9 @@ The name of the queue with non-ASCII characters escaped as in C.
 *`rabbitmq.exchange.vhost`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: rabbitmq.vhost
 
 Virtual host name with non-ASCII characters escaped as in C.
 
@@ -20070,7 +20100,9 @@ Whether the exchange is internal, i.e. cannot be directly published to by a clie
 *`rabbitmq.exchange.user`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: user.name
 
 User who created the exchange.
 
@@ -20389,7 +20421,9 @@ Number of messages which have been written to the message store.
 *`rabbitmq.node.name`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: rabbitmq.node.name
 
 Node name
 
@@ -20526,7 +20560,9 @@ The name of the queue with non-ASCII characters escaped as in C.
 *`rabbitmq.queue.vhost`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: rabbitmq.vhost
 
 Virtual host name with non-ASCII characters escaped as in C.
 
@@ -20566,7 +20602,9 @@ Whether the queue is exclusive (i.e. has owner_pid).
 *`rabbitmq.queue.node`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: rabbitmq.node.name
 
 Node name.
 

metricbeat/module/rabbitmq/_meta/fields.yml

@@ -9,3 +9,12 @@
       type: group
       description: >
       fields:
+        - name: node.name
+          type: keyword
+          description: >
+            Node name
+
+        - name: vhost
+          type: keyword
+          description: >
+            Virtual host name with non-ASCII characters escaped as in C.

metricbeat/module/rabbitmq/connection/_meta/data.json

@@ -19,7 +19,6 @@
             "frame_max": 131072,
             "host": "::1",
             "name": "[::1]:60938 -\u003e [::1]:5672",
-            "node": "nodename",
             "octet_count": {
                 "received": 3764,
                 "sent": 3840
@@ -34,13 +33,18 @@
                 "port": 60938
             },
             "port": 5672,
-            "type": "network",
-            "user": "guest",
-            "vhost": "/"
-        }
+            "type": "network"
+        },
+        "node": {
+            "name": "nodename"
+        },
+        "vhost": "/"
     },
     "service": {
-        "address": "127.0.0.1:54352",
+        "address": "127.0.0.1:53939",
         "type": "rabbitmq"
+    },
+    "user": {
+        "name": "guest"
     }
 }

metricbeat/module/rabbitmq/connection/_meta/fields.yml

@@ -5,19 +5,27 @@
   release: ga
   fields:
     - name: name
-      type: keyword
+      type: alias
+      path: rabbitmq.name
+      migration: true
       description: >
         The name of the connection with non-ASCII characters escaped as in C.
     - name: vhost
-      type: keyword
+      type: alias
+      path: rabbitmq.vhost
+      migration: true
       description: >
         Virtual host name with non-ASCII characters escaped as in C.
     - name: user
-      type: keyword
+      type: alias
+      path: user.name
+      migration: true
       description: >
         User name.
     - name: node
-      type: keyword
+      type: alias
+      path: rabbitmq.node.name
+      migration: true
       description: >
         Node name.
     - name: channels

metricbeat/module/rabbitmq/connection/connection_test.go

@@ -43,9 +43,6 @@ func TestFetchEventContents(t *testing.T) {
 	event := ee.(common.MapStr)
 
 	assert.EqualValues(t, "[::1]:60938 -> [::1]:5672", event["name"])
-	assert.EqualValues(t, "/", event["vhost"])
-	assert.EqualValues(t, "guest", event["user"])
-	assert.EqualValues(t, "nodename", event["node"])
 	assert.EqualValues(t, 8, event["channels"])
 	assert.EqualValues(t, 65535, event["channel_max"])
 	assert.EqualValues(t, 131072, event["frame_max"])

metricbeat/module/rabbitmq/connection/data.go

@@ -22,6 +22,7 @@ import (
 
 	"github.com/joeshaw/multierror"
 
+	"github.com/elastic/beats/libbeat/common"
 	s "github.com/elastic/beats/libbeat/common/schema"
 	c "github.com/elastic/beats/libbeat/common/schema/mapstriface"
 	"github.com/elastic/beats/libbeat/logp"
@@ -80,8 +81,28 @@ func eventsMapping(content []byte, r mb.ReporterV2) {
 
 func eventMapping(connection map[string]interface{}, r mb.ReporterV2) error {
 	fields, err := schema.Apply(connection)
+
+	rootFields := common.MapStr{}
+	if v, err := fields.GetValue("user"); err == nil {
+		rootFields.Put("user.name", v)
+		fields.Delete("user")
+	}
+
+	moduleFields := common.MapStr{}
+	if v, err := fields.GetValue("vhost"); err == nil {
+		moduleFields.Put("vhost", v)
+		fields.Delete("vhost")
+	}
+
+	if v, err := fields.GetValue("node"); err == nil {
+		moduleFields.Put("node.name", v)
+		fields.Delete("node")
+	}
+
 	event := mb.Event{
 		MetricSetFields: fields,
+		RootFields:      rootFields,
+		ModuleFields:    moduleFields,
 	}
 	r.Event(event)
 	return err

metricbeat/module/rabbitmq/exchange/_meta/data.json

@@ -33,13 +33,15 @@
                 }
             },
             "name": "exchange.name",
-            "type": "fanout",
-            "user": "guest",
-            "vhost": "/"
-        }
+            "type": "fanout"
+        },
+        "vhost": "/"
     },
     "service": {
-        "address": "127.0.0.1:55006",
+        "address": "127.0.0.1:53926",
         "type": "rabbitmq"
+    },
+    "user": {
+        "name": "guest"
     }
 }

metricbeat/module/rabbitmq/exchange/_meta/fields.yml

@@ -9,7 +9,9 @@
       description: >
         The name of the queue with non-ASCII characters escaped as in C.
     - name: vhost
-      type: keyword
+      type: alias
+      path: rabbitmq.vhost
+      migration: true
       description: >
         Virtual host name with non-ASCII characters escaped as in C.
     - name: durable
@@ -25,7 +27,9 @@
       description: >
         Whether the exchange is internal, i.e. cannot be directly published to by a client.
     - name: user
-      type: keyword
+      type: alias
+      path: user.name
+      migration: true
       description: >
         User who created the exchange.
 

metricbeat/module/rabbitmq/exchange/data.go

@@ -22,6 +22,7 @@ import (
 
 	"github.com/joeshaw/multierror"
 
+	"github.com/elastic/beats/libbeat/common"
 	s "github.com/elastic/beats/libbeat/common/schema"
 	c "github.com/elastic/beats/libbeat/common/schema/mapstriface"
 	"github.com/elastic/beats/libbeat/logp"
@@ -84,8 +85,23 @@ func eventMapping(exchange map[string]interface{}, r mb.ReporterV2) error {
 		return err
 	}
 
-	event := mb.Event{}
-	event.MetricSetFields = fields
+	rootFields := common.MapStr{}
+	if v, err := fields.GetValue("user"); err == nil {
+		rootFields.Put("user.name", v)
+		fields.Delete("user")
+	}
+
+	moduleFields := common.MapStr{}
+	if v, err := fields.GetValue("vhost"); err == nil {
+		moduleFields.Put("vhost", v)
+		fields.Delete("vhost")
+	}
+
+	event := mb.Event{
+		MetricSetFields: fields,
+		RootFields:      rootFields,
+		ModuleFields:    moduleFields,
+	}
 	r.Event(event)
 	return nil
 }

metricbeat/module/rabbitmq/exchange/exchange_test.go

@@ -54,8 +54,6 @@ func TestFetchEventContents(t *testing.T) {
 	}
 
 	assert.Equal(t, "exchange.name", event["name"])
-	assert.Equal(t, "guest", event["user"])
-	assert.Equal(t, "/", event["vhost"])
 	assert.Equal(t, true, event["durable"])
 	assert.Equal(t, false, event["auto_delete"])
 	assert.Equal(t, false, event["internal"])