fix logstash cgroup mapping

[rpasche]

Related to elastic/kibana#142179

What does this PR do?

It fixes the the mapping of .monitoring-logstash-8-mb, so that Stack Monitoring for Logstash is working again.

I noticed, that the mapping of logstash is broken. The aliases of the cgroup object are allocated on the wrong level.

Today, the aliases is located at logstash_stats.os.cpu.stat, but it should be located at logstash_stats.os.cgroup.cpu.stat. So that the path of the alias are again matching.

Additionally, the metric for cfs_quota_micros was not fetched by the node_stats of logstash. But this metric is also used withih Kibana to calculate another metric. (see example at https://github.com/elastic/kibana/blob/main/x-pack/plugins/monitoring/server/lib/metrics/logstash/metrics.ts#L265 and https://github.com/elastic/kibana/blob/main/x-pack/plugins/monitoring/server/lib/metrics/logstash/metrics.ts#L355)

Why is it important?

It is needed to fix Stack Monitoring to show correct graphs again.

Checklist

No "code" checks have been done. My only "code" change I used was to add the cfs_quota_micros within the node_stats/data.go file (to unmarshal that field from JSON object). The changes to the mapping have only been done by me - so far - manually directly within a dev cluster (within the .monitoring-logstash-8-mb index template. (see screenshots below)

Sorry... nothing from below.

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Issues and PR from within Logstash

• relates: Add support for cgroup v2 logstash#14534, PoC to add cgroup v2 support logstash#14537

Use cases

Screenshots

new field cfs_quota_micros added

aliases moved (here, only the new added)

Results in Stack Monitoring (tested in 8.4.1)

CPU Utilization shown again

CGroup stats showing real values (and not N/A)

Logs

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @rpasche? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-09-30T03:05:20.276+0000

• Duration: 48 min 0 sec

Test stats 🧪

Test	Results
Failed	0
Passed	3859
Skipped	887
Total	4746

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[matschaffer]

/test

[matschaffer]

Thanks for digging into this @rpasche - I'll see if I can first find a v1 cgroups setup I can use to test this directly. If not I'll have to build a container that includes elastic/logstash#14537.

The mappings for these indices live in https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/src/main/resources/monitoring-logstash.json (for logstash internal collection) and https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/src/main/resources/monitoring-logstash-mb.json (for metricbeat collection).

[matschaffer]

Update: I found a cgroup v1 setup I can use and got basic reporting via logstash & metricbeat going. Seeing if I can get the ES templates updated. I'll open a master issue to track the stack monitoring bug (separate from the lack of cgroup v2 support on logtash).

[matschaffer]

This works for me. It wasn't clear to me what was causing the github actions to fail, but I've updated the branch. If it passes, I'll merge it.

I'll keep the issue open until both this and the corresponding mapping change in ES are done.

Thanks for the contribution! 🧡

[matschaffer]

Guessing it's the lint checks making it looks like I need to make update. I'll work on satisfying those tomorrow before merge.