Add container ECS fields in kubernetes metadata

[ChrsMark]

What does this PR do?

This PR adds container.id, container.runtime and container.image.name in kubernetes metadata to be compliant with https://www.elastic.co/guide/en/ecs/current/ecs-container.html

Why is it important?

In final events the metadata do not include container.id, container.runtime and container.image.name.

Related issues

• Closes Container id not included in Kubernetes events #20982
• Related Add ECS container fields for kubernetes #10926

How to test this PR

1. Configure and run Filebeat in k8s:

filebeat.autodiscover:
      providers:
        - type: kubernetes
          node: ${NODE_NAME}
          hints.enabled: true
          hints.default_config:
            type: container
            paths:
              - /var/log/containers/*${data.kubernetes.container.id}.log

Make sure that container.id, container.runtime and container.image.name exist in the final documents in ES.

2. Configure and run Filebeat in k8s:

filebeat.inputs:
    - type: container
      paths:
        - /var/log/containers/*.log
      processors:
        - add_kubernetes_metadata:
            host: ${NODE_NAME}
            indexers:
            - container:
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"

Screenshots

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request #20984 updated]

• Start Time: 2020-09-09T07:11:12.179+0000

• Duration: 76 min 8 sec

Test stats 🧪

Test	Results
Failed	0
Passed	19781
Skipped	1837
Total	21618

[jsoriano]

Good catch! LGTM

It'd be nice to have some test to detect the loss of these fields. We would also need to check if add_kubernetes_metadata has similar issues.

[jsoriano]

Thanks!