[Unified Observability] update network fields

[neptunian]

Resolves #131152

Swaps out usage of non ECS fields system.network.in.bytes and system.network.out.bytes (counters) for ECS fields host.network.ingress.bytes and host.network.egress.bytes which are gauges. These new ECS fields were added in metricbeat 7.14 so users who are on Kibana 8.4+ but on a version of metricbeat prior to 7.14 will have no data until they upgrade metricbeat to at least 7.14.

The new ECS fields according to the docs:
The number of bytes received/sent out (gauge) on all network interfaces by the host since the last metric collection.

The main calculation we now need to do is calculate bytes per second. Since this depends on the user's metricset.period based on the docs, we use (avg) host.network.ingress.bytes / (metricset.period / 1000)
In order to make sure the changes made matched the previous field's calculations I used a TSVB chart to compare:

The query aggs look as follows now:

rx_avg: {
    avg: {
      field: 'host.network.ingress.bytes',
    },
  },
  rx_period: {
    filter: {
      exists: {
        field: 'host.network.ingress.bytes',
      },
    },
    aggs: {
      period: {
        max: {
          field: 'metricset.period',
        },
      },
    },
  },
  rx: {
    bucket_script: {
      buckets_path: {
        value: 'rx_avg',
        period: 'rx_period>period',
      },
      script: {
        source: 'params.value / (params.period / 1000)',
        lang: 'painless',
      },
      gap_policy: 'skip',
    },
  },

I also had to fix an existing bug where we only got the default of 10 interfaces. I found this issue while using my mac as it has a lot more interfaces and I wasn't getting the correct data in any of these places where we report rx/tx. Notice in the tsvb chart I changed the "Top" to 100 under system.network.in.bytes vis in order for the chart to match. We won't need to worry about this when using the new ECS fields because it returns the value of "all network interfaces".

Docs will be updated in another PR.

The following places are affected:
Metrics: "Outbound traffic" and "Inbound traffic" the overlay and Network vis in popover:

Metrics: Inventory panels and vis:

Observability Overview: RX/TX

Inventory Threshold Rule for Inbound/Outbound traffic

[elasticmachine]

Pinging @elastic/infra-monitoring-ui (Team:Infra Monitoring UI)

[elasticmachine]

Pinging @elastic/unified-observability (Team:Unified observability)

[miltonhultgren]

LGTM 👍🏼

[miltonhultgren]

What does this mean?

[neptunian]

it basically means groupBy. when using the system.network fields we grouped by system.network.name which is the network interface name. But now we don't do that now because the new field (host.network) returns the sum of all the interfaces and there is no such equivalent. Generated by this UI:

[crespocarlos]

Cool stuff. Just added a couple of comments

I think we need to update the files in x-pack/test/functional/es_archives/infra/8.0.0/hosts_only so that the tests can reflect these changes

[matschaffer]

@elasticmachine merge upstream

[simianhacker]

There are two spots I noted that I think we should revert the tests. The first one is the Metrics Explorer test that confirms the "rate" aggregation is using the correct backing aggregations for Elasticsearch. Both tests used the field name system.network.in.bytes BUT they are not necessarily tied to that metric. We should change the field from system.network.in.bytes to counter for the tests so it's more ambiguous.

[neptunian]

@elasticmachine merge upstream

[neptunian]

@elasticmachine merge upstream

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 3649d5a
• Storybooks Preview
• Webpack Bundle Analyzer

Failed CI Steps

• FTR Configs #38

Test Failures

• [job] [logs] FTR Configs #38 / endpoint When on the Endpoint Policy Details Page "after all" hook in "When on the Endpoint Policy Details Page"
• [job] [logs] FTR Configs #38 / endpoint When on the Endpoint Policy Details Page "before all" hook in "When on the Endpoint Policy Details Page"

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
infra	1019.6KB	1020.5KB	+947.0B

History

• 💔 Build #55386 failed 5230af2
• 💔 Build #55384 failed 8a21fb4
• 💚 Build #54481 succeeded 7091fce87103f2093be00c7049aa2b1bd0437bb0
• 💚 Build #53243 succeeded ee3a345
• 💔 Build #53155 failed 9c5e56a
• 💔 Build #52970 failed 80ccbf2

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[simianhacker]

LGTM! Thanks for reverting the tests.