[Metricbeat] Use egress/ingress instead of inbound/outbound for system/socket metricset

[andrewstucki]

What does this PR do?

This changes the system/socket metricset to use the new ECS 1.7 host-centric ingress/egress values.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Relates [ECS] Upgrade modules to 1.7 #21674

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #22992 updated

• Start Time: 2020-12-08T21:16:54.493+0000

• Duration: 53 min 51 sec

Test stats 🧪

Test	Results
Failed	0
Passed	2321
Skipped	523
Total	2844

Steps errors

Expand to view the steps failures

Terraform Apply on x-pack/metricbeat/module/aws

• Took 0 min 14 sec . View more details on here

Terraform Apply on x-pack/metricbeat/module/aws

• Took 0 min 15 sec . View more details on here

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	2321
Skipped	523
Total	2844

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[andresrc]

Do we need to make this breaking change at this point?

[jsoriano]

Do we need to make this breaking change at this point?

I guess that @elastic/security-external-integrations are the main users of this field, and this change has been already applied in Winlogbeat #22997 and Auditbeat #22991, so it is probably better to keep consistency on these values.

In any case, @andrewstucki could you please confirm that it is desired to do this breaking change in 7.x?

[andrewstucki]

@jsoriano -- yep, we decided to do the breaking change as part of the ECS 1.7 upgrade.

With the clarification/introduction of the egress/ingress values for network.direction we're actually using the wrong values by continuing to use inbound/outbound (egress/ingress is for a host-centric view of directionality v. a network perimeter view for inbound/outbound, if the host you're on is the ultimate destination for the traffic, you should use egress/ingress now).

Since the addition of those two values was essentially a breaking change in ECS itself (or at least our previous interpretation of it), we are making these breaking changes while upgrading.