Add ECS container fields for kubernetes

[jsoriano]

Kubernetes fields are not migrated to ECS, but from some of them we could extract some common fields:

• kubernetes.container.id has the form runtime://id, we could extract container.runtime and container.id.
• kubernetes.node.name could be copied to some general hostname-like field. (It could be covered by Report host metadata for Kubernetes logs #12790)

[kaiyan-sheng]

@jsoriano Thanks for creating this issue! Is this for 7.x?

[jsoriano]

@kaiyan-sheng this would be nice to have soon, but not required for 7.0 as won't introduce breaking changes, this will only add new fields.

[ruflin]

I remember discussing this with @exekias and there was something like: kubernetes.container.id could be different from the container.id but don't remember why anymore.

[jsoriano]

@ruflin yes, it is different, but we could maybe use it to extract the runtime and the id in the runtime.

[ruflin]

SGTM

[exekias]

Let's move this one forward, specially for container.id, as this is the field used by Infra UI to link logs & metrics. That will make docker metrics correlate with kubernetes logs, for instance

[kaiyan-sheng]

I just realized I won't have the bandwidth to finish this for 7.5.0. Please feel free to pick it up and start working on it!