Cherry-pick elastic#8487 to 6.4: Avoid mapping issues in kubernetes m…

…odule (elastic#8507)

* Avoid mapping issues in kubernetes module (elastic#8487)

* Avoid mapping issues in kubernetes module

This contains 2 changes:

 * Do not report `start_time` when it's empty, as that will throw a
 mapping exception
 * Fix `fields.yml`, as some fields were out of place for `event`
 metricset

(cherry picked from commit 8d72865)

* Update CHANGELOG.asciidoc

CHANGELOG.asciidoc

@@ -37,6 +37,8 @@ https://github.com/elastic/beats/compare/v6.4.1...6.4[Check the HEAD diff]
 
 *Metricbeat*
 
+- Avoid mapping issues in kubernetes module. {pull}8487[8487]
+
 *Packetbeat*
 
 *Winlogbeat*

metricbeat/docs/fields.asciidoc

@@ -8053,6 +8053,27 @@ type: long
 Count field records the number of times the particular event has occurred
 
 
+--
+
+
+*`kubernetes.event.timestamp.first_occurrence`*::
++
+--
+type: date
+
+Timestamp of first occurrence of event
+
+
+--
+
+*`kubernetes.event.timestamp.last_occurrence`*::
++
+--
+type: date
+
+Timestamp of last occurrence of event
+
+
 --
 
 *`kubernetes.event.message`*::

metricbeat/module/kubernetes/container/data.go

@@ -52,8 +52,7 @@ func eventMapping(content []byte, perfMetrics *util.PerfMetricsCache) ([]common.
 					},
 				},
 
-				"name":       container.Name,
-				"start_time": container.StartTime,
+				"name": container.Name,
 
 				"cpu": common.MapStr{
 					"usage": common.MapStr{
@@ -114,6 +113,10 @@ func eventMapping(content []byte, perfMetrics *util.PerfMetricsCache) ([]common.
 				},
 			}
 
+			if container.StartTime != "" {
+				containerEvent.Put("start_time", container.StartTime)
+			}
+
 			if nodeCores > 0 {
 				containerEvent.Put("cpu.usage.node.pct", float64(container.CPU.UsageNanoCores)/1e9/nodeCores)
 			}

metricbeat/module/kubernetes/event/_meta/fields.yml

@@ -9,18 +9,17 @@
     type: long
     description: >
       Count field records the number of times the particular event has occurred
+  - name: timestamp
+    type: group
     fields:
-    - name: timestamp
-      type: group
-      fields:
-      - name: first_occurrence
-        type: date
-        description: >
-          Timestamp of first occurrence of event
-      - name: last_occurrence
-        type: date
-        description: >
-          Timestamp of last occurrence of event
+    - name: first_occurrence
+      type: date
+      description: >
+        Timestamp of first occurrence of event
+    - name: last_occurrence
+      type: date
+      description: >
+        Timestamp of last occurrence of event
   - name: message
     type: keyword
     description: >

metricbeat/module/kubernetes/node/data.go

@@ -34,8 +34,7 @@ func eventMapping(content []byte) (common.MapStr, error) {
 
 	node := summary.Node
 	nodeEvent := common.MapStr{
-		"name":       node.NodeName,
-		"start_time": node.StartTime,
+		"name": node.NodeName,
 
 		"cpu": common.MapStr{
 			"usage": common.MapStr{
@@ -105,5 +104,10 @@ func eventMapping(content []byte) (common.MapStr, error) {
 			},
 		},
 	}
+
+	if node.StartTime != "" {
+		nodeEvent.Put("start_time", node.StartTime)
+	}
+
 	return nodeEvent, nil
 }

metricbeat/module/kubernetes/pod/data.go

@@ -58,8 +58,7 @@ func eventMapping(content []byte, perfMetrics *util.PerfMetricsCache) ([]common.
 					"name": node.NodeName,
 				},
 			},
-			"name":       pod.PodRef.Name,
-			"start_time": pod.StartTime,
+			"name": pod.PodRef.Name,
 
 			"cpu": common.MapStr{
 				"usage": common.MapStr{
@@ -85,6 +84,10 @@ func eventMapping(content []byte, perfMetrics *util.PerfMetricsCache) ([]common.
 			},
 		}
 
+		if pod.StartTime != "" {
+			podEvent.Put("start_time", pod.StartTime)
+		}
+
 		if coresLimit > nodeCores {
 			coresLimit = nodeCores
 		}

metricbeat/module/kubernetes/system/data.go

@@ -44,8 +44,7 @@ func eventMapping(content []byte) ([]common.MapStr, error) {
 					"name": node.NodeName,
 				},
 			},
-			"container":  syscontainer.Name,
-			"start_time": syscontainer.StartTime,
+			"container": syscontainer.Name,
 			"cpu": common.MapStr{
 				"usage": common.MapStr{
 					"nanocores": syscontainer.CPU.UsageNanoCores,
@@ -68,6 +67,11 @@ func eventMapping(content []byte) ([]common.MapStr, error) {
 				"majorpagefaults": syscontainer.Memory.MajorPageFaults,
 			},
 		}
+
+		if syscontainer.StartTime != "" {
+			containerEvent.Put("start_time", syscontainer.StartTime)
+		}
+
 		events = append(events, containerEvent)
 	}