enhancement(docker source): Enrich events with metadata

[ktff]

Closes #1042

There is one open question:

Currently, metadata is coming from two api endpoints, container list and container inspect. They are returning slightly different data:

• created_at, container list returns UNIX timestamp, container inspect returns rfc3339 timestamp
• names, container list returns list of names, container inspect returns one name

This will result in containers having different metadata depending on when was vector started relative to it.

This could be avoided if we only use metadata from container inspect endpoint. With the cost of sometimes additional call to docker api, and loss of extra names. As a side effect, event metadata would instead of list of names have one name.

[LucioFranco]

I'd like to see the task unififcation change but otherwise this looks great.

[ktff]

@LucioFranco and what do you think about the above question regarding different metadata?

[LucioFranco]

@ktff oops, I thought I answered that! I say go with the simple solution of calling inspect when we need it. We should be able to cache the result and it shouldn't be expensive at all.

[ktff]

With the last commit, events will be enriched with one container name, instead of a list of container names.

[binarylogic]

@ktff this looks great! @LucioFranco will be back from vaction next week and we can get this reviewed one last time.

[binarylogic]

Noting, just assigning @LucioFranco for review which will happen next week.

[LucioFranco]

LGTM

[binarylogic]

@ktff this looks great! I'd like to make some changes to the metadata fields.

• The docker specific metadata fields should not reside in event/mod.rs since they are specific to the docker source. Can we remove them from there? Specifically, the STREAM, IMAGE, CONTAINER,CREATED_AT and NAME fields.
• I find some of the naming ambiguous. Can we rename the fields to: container_id, container_name, container_created_at, image, andstream.

I am updating the docs now to reflect these changes. Once done we should be good to merge.

[binarylogic]

I've updated the documentation to reflect the above changes. Once they're made in the code this should be good to merge.

out dated