[Metricbeat]Kubernetes: make state_container metricset ECS compliant

[odacremolbap]

Move existing field kubernetes.container.id, at state_container kubernetes metricset, to the ECS compliant fields.

Origin field contains a string prefixed by the container runtime, and suffixed with the container ID
New fields populated are

• container.runtime
• container.id

Previous field won't be removed until 8.0 elastic stack release.

Fixes #10926

[kaiyan-sheng]

Do the new fields need to be added to fields.yml?

[odacremolbap]

@kaiyan-sheng thanks for taking a look.
new fields are ECS, so I guess they don't

[odacremolbap]

jenkins test this

[odacremolbap]

jenkins, test this

[odacremolbap]

jenkins, test this

[odacremolbap]

jenkins, test this

[odacremolbap]

manual testing:

• run ES + optionally kibana
• deploy kubernetes (could be minikube) and kube-state-metrics as stated here
• deploy metricbeat, you can either use an build candidate image, or use the release branch and the playground pod.
• configure state_container metricset:

- module: kubernetes
  enabled: true
  metricsets:
    - state_container
  period: 10s
  hosts: ["kube-state-metrics.kube-system:8080"]
  in_cluster: true

Expected behaviour:

• Events must still contain kubernetes.container.id
• Field container.runtime exists, and contains the container runtime used
• Field container.id exists, and contains the container unique identifier
• All new fields are already mapped by ECS (no ? shown at kibana

[tbragin]

@sorantis @sgrodzicki @jasonrhodes Do we need any special handling for this change on the Metrics UI front, especially as we move toward 8.0 where the old fields are going to be removed?

[sgrodzicki]

@simianhacker probably knows best

[kaiyan-sheng]

We are looking at removing old fields here in 8.0. @simianhacker Could you confirm here that metrics UI is already switched to use the new field names? TIA!!

[MichaelKatsoulis]

@kaiyan-sheng after discussions in #23585 (comment) we will remove only kubernetes.container.image in 8.0 as its value is duplicated to ECS field container.image.name.
@simianhacker can you confirm that this field is not used in Metrics UI ?

[mukeshelastic]

@elastic/infra-monitoring-ui can someone confirm whether removal of this field will be a problem in kibana metrics UI?