ES index mode & codec in metricbeat (#49237) (#49469)

Add `mode` and `codec` fields to the elasticsearch.index metricset,
sourced from the index /_settings API.

Backport of #49237 to 9.2. Supersedes #49317 which had cherry-pick
conflicts in CHANGELOG.asciidoc.

Author: 3kt

CHANGELOG.asciidoc

@@ -17,6 +17,7 @@ https://github.com/elastic/beats/compare/v9.0.0-rc1\...v9.0.0[View commits]
 
 *Metricbeat*
 
+- Added `mode` and `codec` fields to the `elasticsearch.index` metricset.
 - Add a warning log to `metricbeat.vsphere` in case vSphere connection has been configured as insecure. {pull}43104[43104]
 
 

changelog/fragments/1772635870-es-index-mode-&-codec-in-metricbeat.yaml

@@ -0,0 +1,45 @@
+# REQUIRED
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user's deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: feature
+
+# REQUIRED for all kinds
+# Change summary; a 80ish characters long description of the change.
+summary: Addition of Elasticsearch index mode and codec settings in Metricbeat index stats module.
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# description:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# impact:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# action:
+
+# REQUIRED for all kinds
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: metricbeat
+
+# AUTOMATED
+# OPTIONAL to manually add other PR URLs
+# PR URL: A link the PR that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+# pr: https://github.com/owner/repo/1234
+
+# AUTOMATED
+# OPTIONAL to manually add other issue URLs
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+# issue: https://github.com/owner/repo/1234

docs/reference/metricbeat/exported-fields-elasticsearch.md

@@ -1370,6 +1370,14 @@ index
 :   type: keyword
 
 
+**`elasticsearch.index.mode`**
+:   type: keyword
+
+
+**`elasticsearch.index.codec`**
+:   type: keyword
+
+
 **`elasticsearch.index.name`**
 :   Index name.
 

docs/reference/metricbeat/metricbeat-metricset-elasticsearch-index.md

@@ -170,6 +170,8 @@ Here is an example document generated by this metricset:
         "tier_preference": "data_content",
         "creation_date": 1731657995821,
         "version": "8505000",
+        "mode": "time_series",
+        "codec": "default",
         "hidden": true,
         "shards": {
           "total": 1,

metricbeat/module/elasticsearch/fields.go

@@ -147,6 +147,8 @@
         "tier_preference": "data_content",
         "creation_date": 1731657995821,
         "version": "8505000",
+        "mode": "time_series",
+        "codec": "default",
         "hidden": true,
         "shards": {
           "total": 1,

metricbeat/module/elasticsearch/index/_meta/data.json

@@ -23,6 +23,10 @@
       type: date
     - name: version
       type: keyword
+    - name: mode
+      type: keyword
+    - name: codec
+      type: keyword
     - name: name
       type: keyword
       description: >

metricbeat/module/elasticsearch/index/_meta/fields.yml

@@ -45,6 +45,8 @@ type Index struct {
 	TierPreference string     `json:"tier_preference,omitempty"`
 	CreationDate   string     `json:"creation_date,omitempty"`
 	Version        string     `json:"version,omitempty"`
+	Mode           string     `json:"mode,omitempty"`
+	Codec          string     `json:"codec,omitempty"`
 	Shards         shardStats `json:"shards"`
 }
 
@@ -196,7 +198,7 @@ func eventsMapping(
 	}
 
 	indicesSettingsPattern := "*,-.*"
-	indicesSettingsFilterPaths := []string{"*.settings.index.creation_date", "*.settings.index.**._tier_preference", "*.settings.index.version.created"}
+	indicesSettingsFilterPaths := []string{"*.settings.index.creation_date", "*.settings.index.**._tier_preference", "*.settings.index.version.created", "*.settings.index.mode", "*.settings.index.codec"}
 	indicesSettings, err := elasticsearch.GetIndexSettings(httpClient, httpClient.GetURI(), indicesSettingsPattern, indicesSettingsFilterPaths)
 	if err != nil {
 		return fmt.Errorf("failure retrieving index settings from Elasticsearch: %w", err)
@@ -336,6 +338,13 @@ func addIndexSettings(idx *Index, indicesSettings mapstr.M) error {
 
 	idx.Version = indexVersion
 
+	if indexMode, err := getIndexSettingForIndex(indexSettings, idx.Index, "index.mode"); err == nil {
+		idx.Mode = indexMode
+	}
+	if indexCodec, err := getIndexSettingForIndex(indexSettings, idx.Index, "index.codec"); err == nil {
+		idx.Codec = indexCodec
+	}
+
 	return nil
 }