Cherry-pick of PR #24380 to 7.x branch. Original message:

What does this PR do?

This PR leverages type :alias for kubernetes.container.image so as to copy the fields under ECS container.image.name.
This affects metadata collected by kubernetes autodiscover provider, add_kubernetes_metadata processor and state_container metricset.

Why is it important?

In order to have a persistent way to report ECS container fields, without the need to duplicate fields and store both which will impact ECS.

How to test this PR locally

1. Before all test verify that fields.yml on your testing env is properly updated with the alias change and manually setup and verify that mappings are properly loaded in ES.
2. Check that autodiscover meta work:

filebeat.autodiscover:
      providers:
        - type: kubernetes
          node: ${NODE_NAME}
          hints.enabled: true
          hints.default_config:
            type: container
            paths:
              - /var/log/containers/*${data.kubernetes.container.id}.log

Make sure that container.image.name exist in the final documents in ES and you able to search on based on it while kubernetes.container.image is not populated in the event but is searchable because of the alias.
3. Check that add_kubernetes_metadata processor works:

filebeat.inputs:
    - type: container
      paths:
        - /var/log/containers/*.log
      processors:
        - add_kubernetes_metadata:
            host: ${NODE_NAME}
            indexers:
            - container:
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"

Make sure that container.image.name exist in the final documents in ES and you able to search on based on it while kubernetes.container.image is not populated in the event but is searchable because of the alias.

4. Verify with state_container metricset enabled that, container.image.name exist in the final documents in ES and you able to search based on it while kubernetes.container.image is not populated in the event but is searchable because of the alias.

Related issues

• Closes Verify ECS alignment in container fields reported by kubernetes module and meta processor #23585
• Relates Add container ECS fields in kubernetes metadata #20984, Add container image and container name ECS fields for state_container #23802

Screenshots