[8.19](backport #49237) ES index mode & codec in metricbeat

[mergify]

Type of change: Enhancement

Proposed commit message

Add mode and codec fields to the elasticsearch.index metricset

WHAT:

• Add two optional fields to the Metricbeat Elasticsearch index metricset: elasticsearch.index.mode (e.g. time_series) and elasticsearch.index.codec (e.g. default, best_compression, none), sourced from the index /_settings API.
• Extend the existing index-settings flow (GetIndexSettings + addIndexSettings) with filter_path entries for *.settings.index.mode and *.settings.index.codec, and populate the new fields in addIndexSettings only when present.
• Add mode and codec to the Index struct (omitempty), to the index metricset fields.yml (keyword), to the sample data.json, and to CHANGELOG.asciidoc.

WHY:

• Enables monitoring and filtering of index mode (e.g. time-series vs standard) and compression codec from Metricbeat, reusing the same _settings-based scaffolding used for tier_preference, creation_date, and version (PR Additional stats fields for Elasticsearch #41944). Both fields are optional so missing settings do not break event collection.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

None. The change only adds optional fields. Existing dashboards and queries are unchanged; new fields appear in events when the Elasticsearch index exposes index.mode or index.codec in /_settings.

Author's Checklist

• Verified new fields are populated when index has mode/codec in _settings
• Verified behaviour unchanged when mode/codec are missing (fields omitted, no error)
• Regenerate field docs with mage FieldsDocs (or make update) if required by project workflow

How to test this PR locally

1. Build and run Metricbeat with the Elasticsearch module and index metricset enabled against a cluster that has indices (some with index.mode or index.codec set if possible).
2. Ingest events and confirm elasticsearch.index.mode and/or elasticsearch.index.codec appear when the index settings are present.
3. Confirm events for indices without these settings still publish and do not include the new fields (or include them empty/omitted).

Related issues

• Relates to the approach in Additional stats fields for Elasticsearch #41944 (tier_preference, creation_date, version).

Use cases

• As an operator, I can filter or aggregate Metricbeat index metrics by index mode (e.g. time_series) or codec (e.g. best_compression) in Kibana or downstream systems.
• As an operator, I can see index mode and codec in the same index metricset events as tier_preference, creation_date, and version, without changing existing behaviour when those settings are absent.

Screenshots

N/A

Logs

N/A

---

This is an automatic backport of pull request #49237 done by Mergify.

[mergify]

Cherry-pick of 7dc72ea has failed:

On branch mergify/bp/8.19/pr-49237
Your branch is up to date with 'origin/8.19'.

You are currently cherry-picking commit 7dc72eae2.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   CHANGELOG.asciidoc
	new file:   changelog/fragments/1772635870-es-index-mode-&-codec-in-metricbeat.yaml
	modified:   metricbeat/module/elasticsearch/fields.go
	modified:   metricbeat/module/elasticsearch/index/_meta/data.json
	modified:   metricbeat/module/elasticsearch/index/_meta/fields.yml
	modified:   metricbeat/module/elasticsearch/index/data.go

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   docs/reference/metricbeat/exported-fields-elasticsearch.md
	deleted by us:   docs/reference/metricbeat/metricbeat-metricset-elasticsearch-index.md

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[github-actions]

Vale Linting Results

Summary: 4 suggestions found

💡 Suggestions (4)

File	Line	Rule	Message
docs/reference/metricbeat/exported-fields-elasticsearch.md	1100	Elastic.Wordiness	Consider using 'because' instead of 'since'.
docs/reference/metricbeat/exported-fields-elasticsearch.md	1320	Elastic.Wordiness	Consider using 'because' instead of 'since'.
docs/reference/metricbeat/exported-fields-elasticsearch.md	1332	Elastic.Wordiness	Consider using 'because' instead of 'since'.
docs/reference/metricbeat/metricbeat-metricset-elasticsearch-index.md	19	Elastic.WordChoice	Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[belimawr]

@3kt 8.19 still uses the ascii doc files, so you will have to update the doc files from this branch manually.

[mergify]

This pull request has not been merged yet. Could you please review and merge it @3kt? 🙏

[3kt]

@3kt 8.19 still uses the ascii doc files, so you will have to update the doc files from this branch manually.

It doesn't look like I have permissions:

❯ git push upstream mergify/bp/8.19/pr-49237
ERROR: Permission to elastic/beats.git denied to 3kt.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Or is there another way for me to get this through?