Make elasticsearch/shard metricset work for Stack Monitoring without xpack.enabled flag

metricbeat/docs/fields.asciidoc

@@ -18134,6 +18134,43 @@ Elasticsearch module
 
 
 
+*`shard.primary`*::
++
+--
+type: alias
+
+alias to: elasticsearch.shard.primary
+
+--
+
+*`shard.state`*::
++
+--
+type: alias
+
+alias to: elasticsearch.shard.state
+
+--
+
+*`shard.index`*::
++
+--
+type: alias
+
+alias to: elasticsearch.index.name
+
+--
+
+*`shard.node`*::
++
+--
+type: alias
+
+alias to: elasticsearch.node.name
+
+--
+
+
 *`cluster_state.nodes_hash`*::
 +
 --
@@ -22123,6 +22160,21 @@ type: keyword
 
 --
 
+
+*`elasticsearch.shard.source_node.name`*::
++
+--
+type: keyword
+
+--
+
+*`elasticsearch.shard.source_node.uuid`*::
++
+--
+type: keyword
+
+--
+
 [[exported-fields-envoyproxy]]
 == Envoyproxy fields
 

metricbeat/module/elasticsearch/_meta/fields.yml

@@ -6,6 +6,21 @@
   settings: ["ssl", "http"]
   short_config: false
   fields:
+    - name: shard
+      type: group
+      fields:
+        - name: primary
+          type: alias
+          path: elasticsearch.shard.primary
+        - name: state
+          type: alias
+          path: elasticsearch.shard.state
+        - name: index
+          type: alias
+          path: elasticsearch.index.name
+        - name: node
+          type: alias
+          path: elasticsearch.node.name
     - name: cluster_state
       type: group
       fields:

metricbeat/module/elasticsearch/elasticsearch_integration_test.go

@@ -162,11 +162,6 @@ func TestXPackEnabled(t *testing.T) {
 				require.NoError(t, err)
 				require.Len(t, events, numShards)
 
-				for _, event := range events {
-					require.Equal(t, "shards", event.RootFields["type"])
-					require.Regexp(t, `^.monitoring-es-\d-mb`, event.Index)
-				}
-
 				return
 			}
 

metricbeat/module/elasticsearch/shard/_meta/data.json

@@ -1,40 +1,43 @@
 {
     "@timestamp": "2017-10-12T08:05:34.853Z",
-    "beat": {
-        "hostname": "host.example.com",
-        "name": "host.example.com"
-    },
     "elasticsearch": {
         "cluster": {
-            "id": "91RpCx2xSQ21pVPTZfDK0Q",
-            "name": "elasticsearch",
+            "id": "tMjf3CQ_TyCXNfcoR9eTWw",
+            "name": "docker-cluster",
             "state": {
-                "id": "MBE4XrQOSf6ScXRTuCO1Pw"
+                "id": "n-UoXaqYRoOe9qAC76IG6A"
             }
         },
         "index": {
-            "name": "heartbeat-7.0.0-alpha1-2018.08.27"
+            "name": ".apm-agent-configuration"
         },
         "node": {
-            "name": "Z4hBonPxQVW9qPKEHpwWCg"
+            "name": "hx-oJ1-aT_-5pRG22JMI1Q"
         },
         "shard": {
             "number": 0,
             "primary": true,
             "relocating_node": {
                 "name": null
             },
+            "source_node": {
+                "name": "1fb2aa83efac",
+                "uuid": "hx-oJ1-aT_-5pRG22JMI1Q"
+            },
             "state": "STARTED"
         }
     },
+    "event": {
+        "dataset": "elasticsearch.shard",
+        "duration": 115000,
+        "module": "elasticsearch"
+    },
     "metricset": {
-        "host": "127.0.0.1:9200",
-        "module": "elasticsearch",
         "name": "shard",
-        "namespace": "elasticsearch.shard",
-        "rtt": 115
+        "period": 10000
     },
     "service": {
-        "name": "elasticsearch"
+        "address": "127.0.0.1:41773",
+        "type": "elasticsearch"
     }
 }

metricbeat/module/elasticsearch/shard/_meta/fields.yml

@@ -20,3 +20,10 @@
       type: keyword
       description: >
         The node the shard was relocated from.
+    - name: source_node
+      type: group
+      fields:
+        - name: name
+          type: keyword
+        - name: uuid
+          type: keyword