[AWS] Add MSK integration (#9133)

packages/aws/_dev/build/docs/kafka.md

@@ -0,0 +1,48 @@
+# Amazon Managed Streaming for Apache Kafka (MSK)
+
+The Amazon Kafka integration allows you to monitor [Amazon MSK](https://aws.amazon.com/msk/) — it's a fully managed 
+service that makes it easy for you to build and run applications that use Apache Kafka to process streaming data
+
+Use the Amazon Kafka integration to collect metrics related to your MSK clusters from CloudWatch. This integration only
+supports collecting DEFAULT level monitoring metrics for now. Once these metrics are sent to Elastic, you can visualize 
+them in Kibana, create alerts to notify you if something goes wrong, and reference the metrics when troubleshooting 
+an issue.
+
+**IMPORTANT: Extra AWS charges on AWS API requests will be generated by this integration. Please refer to the AWS 
+integration for more details.**
+
+## Data streams
+
+The Amazon Kafka integration collects one type of data: metrics.
+
+**Metrics** give you insight into the state of Amazon MSK.
+The metrics collected by the Amazon Kafka integration include bytes received from clients, bytes sent to clients, number
+of incoming messages and more. See more details in the [Metrics reference](#metrics-reference)
+
+## Requirements
+
+You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it.
+You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.
+
+Before using any AWS integration you will need:
+
+* **AWS Credentials** to connect with your AWS account.
+* **AWS Permissions** to make sure the user you're using to connect has permission to share the relevant data.
+
+For more details about these requirements, see the **AWS** integration documentation.
+
+## Setup
+
+Use this integration if you only need to collect data from the Amazon MSK service.
+
+If you want to collect data from two or more AWS services, consider using the **AWS** integration.
+When you configure the AWS integration, you can collect data from as many AWS services as you'd like.
+
+For step-by-step instructions on how to set up an integration, see the
+{{ url "getting-started-observability" "Getting started" }} guide.
+
+## Metrics reference
+
+{{event "kafka_metrics"}}
+
+{{fields "kafka_metrics"}}

packages/aws/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.13.0"
+  changes:
+    - description: Add Amazon MSK integration
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/9133
 - version: "2.12.2"
   changes:
     - description: Fix an issue were the "_id" field was being used to aggregate data in Severity Over Time dashboard.

packages/aws/data_stream/kafka_metrics/agent/stream/stream.yml.hbs

@@ -0,0 +1,99 @@
+metricsets: ["cloudwatch"]
+period: {{period}}
+{{#if data_granularity}}
+data_granularity: {{data_granularity}}
+{{/if}}
+{{#if include_linked_accounts}}
+include_linked_accounts: {{include_linked_accounts}}
+{{/if}}
+{{#if access_key_id}}
+access_key_id: {{access_key_id}}
+{{/if}}
+{{#if secret_access_key}}
+secret_access_key: {{secret_access_key}}
+{{/if}}
+{{#if session_token}}
+session_token: {{session_token}}
+{{/if}}
+{{#if credential_profile_name}}
+credential_profile_name: {{credential_profile_name}}
+{{/if}}
+{{#if shared_credential_file}}
+shared_credential_file: {{shared_credential_file}}
+{{/if}}
+{{#if role_arn}}
+role_arn: {{role_arn}}
+{{/if}}
+{{#if default_region}}
+default_region: {{default_region}}
+{{/if}}
+{{#if regions}}
+regions:
+{{#each regions as |region i|}}
+- {{region}}
+{{/each}}
+{{/if}}
+{{#if latency}}
+latency: {{latency}}
+{{/if}}
+{{#if tags_filter}}
+tags_filter: {{tags_filter}}
+{{/if}}
+{{#if proxy_url }}
+proxy_url: {{proxy_url}}
+{{/if}}
+metrics:
+- namespace: AWS/Kafka
+  resource_type: kafka
+  statistic: ["Sum"]
+  name:
+  - ActiveControllerCount
+  - BytesInPerSec
+  - BytesOutPerSec
+  - ClientConnectionCount
+  - ConnectionCount
+  - EstimatedMaxTimeLag
+  - FetchMessageConversionsPerSec
+  - GlobalPartitionCount
+  - GlobalTopicCount
+  - LeaderCount
+  - MessagesInPerSec
+  - NetworkRxDropped
+  - NetworkRxErrors
+  - NetworkRxPackets
+  - NetworkTxDropped
+  - NetworkTxErrors
+  - NetworkTxPackets
+  - MaxOffsetLag
+  - ProduceMessageConversionsPerSec
+  - SumOffsetLag
+- namespace: AWS/Kafka
+  resource_type: kafka
+  statistic: ["Average"]
+  name:
+  - BurstBalance
+  - CPUCreditBalance
+  - CpuIdle
+  - CpuIoWait
+  - CpuSystem
+  - CpuUser
+  - KafkaAppLogsDiskUsed
+  - KafkaDataLogsDiskUsed
+  - LeaderCount
+  - MemoryBuffered
+  - MemoryCached
+  - MemoryFree
+  - HeapMemoryAfterGC
+  - MemoryUsed
+  - OfflinePartitionsCount
+  - PartitionCount
+  - ProduceTotalTimeMsMean
+  - RequestBytesMean
+  - RequestTime
+  - RootDiskUsed
+  - SwapFree
+  - SwapUsed
+  - TrafficShaping
+  - UnderMinIsrPartitionCount
+  - UnderReplicatedPartitions
+  - ZooKeeperRequestLatencyMsMean

packages/aws/data_stream/kafka_metrics/elasticsearch/ingest_pipeline/default.yml

@@ -0,0 +1,20 @@
+---
+description: "Pipeline for Amazon MSK metrics"
+
+processors:
+  - rename:
+      field: aws.dimensions.Cluster Name
+      target_field: aws.dimensions.ClusterName
+      ignore_missing: true
+  - rename:
+      field: aws.dimensions.Consumer Group
+      target_field: aws.dimensions.ConsumerGroup
+      ignore_missing: true
+  - rename:
+      field: aws.dimensions.Broker ID
+      target_field: aws.dimensions.BrokerID
+      ignore_missing: true
+  - rename:
+      field: aws.dimensions.Client Authentication
+      target_field: aws.dimensions.ClientAuthentication
+      ignore_missing: true

packages/aws/data_stream/kafka_metrics/fields/agent.yml

@@ -0,0 +1,35 @@
+- name: cloud
+  title: Cloud
+  group: 2
+  description: Fields related to the cloud or infrastructure the events are coming from.
+  footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.'
+  type: group
+  fields:
+    - name: image.id
+      type: keyword
+      description: Image ID for the cloud instance.
+- name: host
+  title: Host
+  group: 2
+  description: 'A host is defined as a general computing instance.
+
+    ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.'
+  type: group
+  fields:
+    - name: containerized
+      type: boolean
+      description: >
+        If the host is a container.
+
+    - name: os.build
+      type: keyword
+      example: "18D109"
+      description: >
+        OS build information.
+
+    - name: os.codename
+      type: keyword
+      example: "stretch"
+      description: >
+        OS codename, if any.
+

packages/aws/data_stream/kafka_metrics/fields/base-fields.yml

@@ -0,0 +1,16 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
+- name: '@timestamp'
+  type: date
+  description: Event timestamp.
+- name: event.module
+  type: constant_keyword
+  description: Event module
+  value: aws

packages/aws/data_stream/kafka_metrics/fields/ecs.yml

@@ -0,0 +1,70 @@
+- external: ecs
+  name: cloud
+- external: ecs
+  name: cloud.account.id
+  dimension: true
+- external: ecs
+  name: cloud.account.name
+- external: ecs
+  name: cloud.availability_zone
+- external: ecs
+  name: cloud.instance.id
+- external: ecs
+  name: cloud.machine.type
+- external: ecs
+  name: cloud.provider
+- external: ecs
+  name: cloud.region
+  dimension: true
+- external: ecs
+  name: ecs.version
+- external: ecs
+  name: error
+- external: ecs
+  name: error.message
+- external: ecs
+  name: service.type
+- external: ecs
+  name: host.architecture
+- external: ecs
+  name: host.domain
+- external: ecs
+  name: host.hostname
+- external: ecs
+  name: host.id
+- external: ecs
+  name: host.ip
+- external: ecs
+  name: host.mac
+- external: ecs
+  name: host.name
+- external: ecs
+  name: host.os.family
+- external: ecs
+  name: host.os.kernel
+- external: ecs
+  name: host.os.name
+- external: ecs
+  name: host.os.platform
+- external: ecs
+  name: host.os.version
+- external: ecs
+  name: host.type
+- external: ecs
+  name: cloud.instance.name
+- external: ecs
+  name: cloud.project.id
+- external: ecs
+  name: container.id
+- external: ecs
+  name: container.image.name
+- external: ecs
+  name: container.labels
+- external: ecs
+  name: container.name
+- name: agent.id
+  external: ecs
+  dimension: true
+- external: ecs
+  name: event.dataset
+  type: constant_keyword