Fix ECS fields in Elastic Log Driver, change index prefix

[fearful-symmetry]

What does this PR do?

• Report the correct hostname and properly separated container names in ECS fields
• Change the prefix to logs-docker so documents show up in the Kibana logs UI

Why is it important?

Although the ECS fields themselves are an issue, we also want Log Driver documents to be easily discoverable in Kibana with little additional configuration. The Logs UI will look for logs-* index patterns by default.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

• Checkout PR locally
• Run mage BuildAndInstall
• Run the plugin using the examples provided in the docs
• Make sure any host.* and container.* fields are correct, and that logs show up in the Kibana log UI
• The end result should look something like this:

{
  "_index": ".ds-logs-docker-8.0.0-2020.08.10-000001",
  "_type": "_doc",
  "_id": "_p2a2nMBsYRBGP3GiK5-",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2020-08-10T23:00:26.046Z",
    "container": {
      "labels": {},
      "id": "6abc8bcd301162fe156d0d560362501a9215c8e9e24e582247ad49dfa9ed1872",
      "name": "awesome_heisenberg",
      "image": {
        "name": "redis",
        "tag": "latest"
      }
    },
    "host": {
      "name": "buzzard.nest"
    },
    "ecs": {
      "version": "1.5.0"
    },
    "agent": {
      "type": "elastic-log-driver",
      "version": "8.0.0",
      "ephemeral_id": "617bcc47-3640-4866-8725-6f22546d53ba",
      "id": "a5308b40-344e-41ab-a985-212075a9762a",
      "name": "buzzard.nest"
    },
    "message": "1:M 10 Aug 2020 23:00:26.045 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect."
  },
  "fields": {
    "@timestamp": [
      "2020-08-10T23:00:26.046Z"
    ]
  },
  "sort": [
    1597100426046
  ]
}

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request #20522 updated]

• Start Time: 2020-08-12T16:34:50.562+0000

• Duration: 29 min 56 sec

Test stats 🧪

Test	Results
Failed	0
Passed	3
Skipped	0
Total	3

[urso]

Instead of creating and passing the hostname around from here, would it make sense to create a beat.Info instead?

[urso]

This might be a little confusing for Beats users. Libbeat also provides a 'global' name setting, but defaults to the hostname if name is not configured. This is done, because name is used by users to identify a single instance (e.g. if multiple beats are run on a single host). Do we want to default to the hostname instead of agent.type as well?

[fearful-symmetry]

Yah, @urso The use of name and such within libbeat is...really confusing and I wasn't totally sure how to handle it. beat.Info has a hostname field, but it's ignored if name is empty. This was the least awkward way I could think of to many sure host.hostname had an actual hostname, since it tends to get overwritten with agent.name if you're not careful. What should the default value for agent.Name be? The hostname? agent.type ?

[urso]

What should the default value for agent.Name be? The hostname? agent.type ?

The hostname.

According to our docs the 'name' setting defaults to hostname: https://www.elastic.co/guide/en/beats/filebeat/current/configuration-general-options.html#_name

NewBeat also initializes Name to hostname. The Name field will be overwritten by the beatConfig.Name, if beatConfig.Name is not empty.

[fearful-symmetry]

So, right now it looks like we're "in line" with how other parts of libbeat work. We default to the hostname if the user doesn't set anything.

[fearful-symmetry]

Alright, fixed the docs so hopefully it's a little more clear.