add dimensions to process data_stream

Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>

Author: tetianakravchenko

packages/system/changelog.yml

@@ -1,7 +1,7 @@
 # newer versions go on top
 - version: "1.28.0"
  changes:
- - description: Add dimension fields to metrics all data_streams, except core and processor to support TSDS migration
+ - description: Add dimension fields to metrics all data_streams, except core to support TSDS migration
  type: enhancement
  link: https://github.com/elastic/integrations/pull/6118
 - version: "1.27.1"

packages/system/data_stream/process/fields/agent.yml

@@ -13,18 +13,21 @@
 
  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.'
  example: 666777888999
+ dimension: true
  - name: availability_zone
  level: extended
  type: keyword
  ignore_above: 1024
  description: Availability zone in which this host is running.
  example: us-east-1c
+ dimension: true
  - name: instance.id
  level: extended
  type: keyword
  ignore_above: 1024
  description: Instance ID of the host machine.
  example: i-1234567890abcdef0
+ dimension: true
  - name: instance.name
  level: extended
  type: keyword
@@ -42,12 +45,14 @@
  ignore_above: 1024
  description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
  example: aws
+ dimension: true
  - name: region
  level: extended
  type: keyword
  ignore_above: 1024
  description: Region in which this host is running.
  example: us-east-1
+ dimension: true
  - name: project.id
  type: keyword
  description: Name of the project in Google Cloud.
@@ -67,6 +72,7 @@
  type: keyword
  ignore_above: 1024
  description: Unique container id.
+ dimension: true
  - name: image.name
  level: extended
  type: keyword
@@ -134,6 +140,7 @@
  level: core
  type: keyword
  ignore_above: 1024
+ dimension: true
  description: 'Name of the host.
 
  It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.'
@@ -202,6 +209,13 @@
  description: Process metrics.
  type: group
  fields:
+ - name: pid
+ level: core
+ type: long
+ ignore_above: 1024
+ description: 'Process id.'
+ dimension: true
+
  - name: state
  type: keyword
  description: >

packages/system/data_stream/process/fields/ecs.yml

@@ -48,3 +48,6 @@
  external: ecs
 - name: service.type
  external: ecs
+- external: ecs
+ name: agent.id
+ dimension: true

packages/system/docs/README.md

@@ -1800,6 +1800,7 @@ If running as less privileged user, it may not be able to read process data belo
 | Field | Description | Type | Unit | Metric Type |
 |---|---|---|---|---|
 | @timestamp | Event timestamp. | date | | |
+| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword | | |
 | cloud.image.id | Image ID for the cloud instance. | keyword | | |
@@ -1826,7 +1827,7 @@ If running as less privileged user, it may not be able to read process data belo
 | host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | |
 | host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | |
 | host.ip | Host ip addresses. | ip | | |
-| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | |
+| host.mac | Host mac addresses. | keyword | | |
 | host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | |
 | host.os.build | OS build information. | keyword | | |
 | host.os.codename | OS codename, if any. | keyword | | |
@@ -1835,7 +1836,7 @@ If running as less privileged user, it may not be able to read process data belo
 | host.os.full.text | Multi-field of `host.os.full`. | match_only_text | | |
 | host.os.kernel | Operating system kernel version as a raw string. | keyword | | |
 | host.os.name | Operating system name, without the version. | keyword | | |
-| host.os.name.text | Multi-field of `host.os.name`. | text | | |
+| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | | |
 | host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | |
 | host.os.version | Operating system version as a raw string. | keyword | | |
 | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | |