Cherry-pick of PR #15947 to 7.x branch. Original message:

Type of change

• Enhancement

What does this PR do?

This PR enables add process metadata to enrich container id in Kubernetes environment by cgroup using process id.

Why is it important?

Include important metadata of the container id in the Kubernetes environment, which beats don't have this ability yet.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works

Author's Checklist

• [ ]

How to test this PR locally

Deploy Auditbeat in minikube with the include_cid set to true. Deploy an sshd server in minikube. After the Auditbeat is running, ssh into the sshd server, which will trigger an Auditbeat event. See if the event coming from the sshd container is enriched with container id cid

Related issues

Closes #14967

Use cases

Screenshots

Logs