Add missing host.* fields to fields.yml

[cwurm]

The add_host_metadata processor (default since 6.5) fills the fields host.os.build and host.containerized, but there is no entry for them in fields.yml so they are missing from the generated index patterns.

This adds them to add_host_metadata/_meta/fields.yml.

#10992 already addressed this for 6.7.

[webmat]

I don't object to adding these fields to Beats, however neither of these fields is defined in ECS. So please add them to fields.common.yml.

Alternately, the source of the event could populate host.os.version instead, with the full version string.

I must say containerized doesn't have a clear mapping in ECS, though. I'm making a note to look into this.

[cwurm]

@webmat To be clear, these fields are currently produced by all Beats by default since the add_host_metadata processor was added to the default config in 6.5. Even before, these fields were presumably (I didn't check) produced when the processor was enabled.

I might have dodged a bullet here. I was afraid I'd have to invent a new top-level key with an accompanying "Exported fields" docs section. But luckily, we already have a "Host fields" section that is currently empty (e.g. here) that I've now re-used. Let me know what you think of this solution.

Eventually, we might need a top-level section for non-ECS fields common to all Beats. The existing "Common" sections are Beat-specific, unfortunately.

[webmat]

Thanks for making the change!

I had in mind libbeat/_meta/fields.common.yml, but I think this specific processor's field defs is even better 👍