[elastic_agent] Restore deleted apm_server_metrics mapping

[carsonip]

Proposed commit message

A stop gap PR to restore deleted apm_server_metrics mapping deleted in regression #12793 . What's new compared to pre #12793 is that metric_type is added for all the concerned metrics.

Tested with 2 scenarios:

• Ingest data then upgrade EA integration: apm-server metrics ingested after upgrade are mapped.
• Upgrade EA integration only then ingest data: apm-server metrics are mapped.

Out of scope of PR: We should follow up with a complete validated PR for apm_server_metrics after elastic/apm-server#21001

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Start a QA ECH deployment.
Locally, start a docker container for EA enrollment docker run --rm -it buildpack-deps:24.04-curl.
Follow kibana fleet UI instructons, create a new agent policy, then install and enroll Elastic Agent in docker container with --install-server.
Enable agent logs and metrics shipping. Add APM to agent policy, enable TBS. Hit the apm endpoint http://localhost:8200 in the agent machine.

Then to install the new EA integration:

cd packages/elastic_agent

export ELASTIC_PACKAGE_KIBANA_HOST=https://test-863450.kb.us-central1.gcp.qa.cld.elstc.co
export ELASTIC_PACKAGE_ELASTICSEARCH_HOST=https://test-863450.es.us-central1.gcp.qa.cld.elstc.co
export ELASTIC_PACKAGE_ELASTICSEARCH_USERNAME="elastic"
export ELASTIC_PACKAGE_ELASTICSEARCH_PASSWORD="xxx"

elastic-package stack up -v -d --provider environment

elastic-package stack status

elastic-package stack up -v -d --services package-registry
elastic-package build -v
elastic-package install -v

Related issues

Fixes elastic/apm-server#20991

Screenshots

[github-actions]

TL;DR

Buildkite failed in Check integrations elastic_agent because apm_server_metrics defines beat.stats.libbeat.output.* fields twice in packages/elastic_agent/data_stream/apm_server_metrics/fields/beat-stats-fields.yml. Remove the duplicate libbeat.output subtree (or merge it into the existing one) and rerun package lint.

Remediation

• Keep only one definition for beat.stats.libbeat.output.events.{active,batches,dropped,duplicates,failed,toomany,total} and beat.stats.libbeat.output.write.{bytes,errors} in packages/elastic_agent/data_stream/apm_server_metrics/fields/beat-stats-fields.yml.
• In the current PR commit (628377c774f6e9505f825e484e609111b7852a54), the first libbeat.output block appears around lines 270-367, and a second duplicate libbeat.output block appears again around lines 875-958.
• Re-run: .buildkite/scripts/test_one_package.sh packages/elastic_agent origin/main 628377c774f6e9505f825e484e609111b7852a54 (or elastic-package lint for this package) to confirm duplicates are gone.

Investigation details

Root Cause

elastic-package lint fails because the same flattened field paths are declared twice in the same datastream field file. The duplicate block is in packages/elastic_agent/data_stream/apm_server_metrics/fields/beat-stats-fields.yml and redefines libbeat.output.events.* and libbeat.output.write.* that were already defined earlier in the file.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/43675
• Job/step: Check integrations elastic_agent
• Key log excerpt:

Error: checking package failed: linting package failed: found 10 validation errors:
1. field "beat.stats.libbeat.output.events.active" is defined multiple times for data stream "apm_server_metrics" .../fields/beat-stats-fields.yml, .../fields/beat-stats-fields.yml
...
10. field "beat.stats.libbeat.output.events.toomany" is defined multiple times ...

I also flattened the PR version of beat-stats-fields.yml and confirmed duplicate paths for:

• beat.stats.libbeat.output.events.{acked,active,batches,dropped,duplicates,failed,toomany,total}
• beat.stats.libbeat.output.write.{bytes,errors}

Verification

• Not run locally in this environment for the PR head SHA (branch commit is not present in local git checkout), but the failure is deterministic from the Buildkite lint output and duplicate field definitions in the PR commit content.

Follow-up

If both blocks were intentional, split one under a different namespace (for example not under beat.stats.libbeat.output) so flattened field paths remain unique.

Note

🔒 Integrity filter blocked 7 items

The following items were blocked because they don't meet the GitHub integrity level.

• [elastic_agent] Restore deleted apm_server_metrics mapping #19265 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19265 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• 628377c list_commits: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• cc8af15 list_commits: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• 7000d19 list_commits: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• e4a085a list_commits: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• 2a55beb list_commits: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 suggestion found

💡 Suggestions (1): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/elastic_agent/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 81da980

History

• 💚 Build #43684 succeeded 8e622dc
• 💔 Build #43675 failed 628377c

[elastic-vault-github-plugin-prod]

Package elastic_agent - 2.9.3 containing this change is available at https://epr.elastic.co/package/elastic_agent/2.9.3/