add unit file states to system/service

CHANGELOG.next.asciidoc

@@ -839,6 +839,7 @@ same journal. {pull}18467[18467]
 - Map cloud data filed `cloud.account.id` to azure subscription.  {pull}21483[21483] {issue}21381[21381]
 - Move s3_daily_storage and s3_request metricsets to use cloudwatch input. {pull}21703[21703]
 - Duplicate system.process.cmdline field with process.command_line ECS field name. {pull}22325[22325]
+- Add unit file states to system/service {pull}22557[22557]
 
 *Packetbeat*
 

metricbeat/docs/fields.asciidoc

@@ -42885,6 +42885,24 @@ type: keyword
 
 --
 
+*`system.service.unit_file.state`*::
++
+--
+The state of the unit file
+
+type: keyword
+
+--
+
+*`system.service.unit_file.vendor_preset`*::
++
+--
+The default state of the unit file
+
+type: keyword
+
+--
+
 [float]
 === resources
 

metricbeat/module/system/service/_meta/data.json

@@ -10,32 +10,28 @@
         "period": 10000
     },
     "process": {
-        "pid": 811
+        "exit_code": 0,
+        "pid": 259
     },
     "service": {
         "type": "system"
     },
     "system": {
         "service": {
+            "exec_code": "exited",
             "load_state": "loaded",
-            "name": "NetworkManager.service",
-            "resources": {
-                "memory": {
-                    "usage": {
-                        "bytes": 15646720
-                    }
-                },
-                "tasks": {
-                    "count": 4
-                }
-            },
-            "state": "active",
-            "state_since": "2019-10-18T21:24:57.581561-07:00",
-            "sub_state": "running"
+            "name": "dracut-pre-udev.service",
+            "state": "inactive",
+            "state_since": "2020-08-26T18:05:23.525244-07:00",
+            "sub_state": "dead",
+            "unit_file": {
+                "state": "static",
+                "vendor_preset": "disabled"
+            }
         }
     },
     "systemd": {
-        "fragment_path": "/usr/lib/systemd/system/NetworkManager.service",
-        "unit": "NetworkManager.service"
+        "fragment_path": "/usr/lib/dracut/modules.d/98dracut-systemd/dracut-pre-udev.service",
+        "unit": "dracut-pre-udev.service"
     }
 }

metricbeat/module/system/service/_meta/fields.yml

@@ -22,6 +22,12 @@
     - name: exec_code
       type: keyword
       description: The SIGCHLD code from the service's main process
+    - name: unit_file.state
+      type: keyword
+      description: The state of the unit file
+    - name: unit_file.vendor_preset
+      type: keyword
+      description: The default state of the unit file
     - name: resources
       type: group
       description: system metrics associated with the service

metricbeat/module/system/service/data.go

@@ -54,6 +54,9 @@ type Properties struct {
 	ActiveExitTimestamp    uint64
 	// Meta
 	FragmentPath string
+	// UnitFileState
+	UnitFileState  string
+	UnitFilePreset string
 }
 
 // formProperties gets properties for the systemd service and returns a MapStr with useful data
@@ -71,6 +74,10 @@ func formProperties(unit dbus.UnitStatus, props Properties) (mb.Event, error) {
 		"load_state": unit.LoadState,
 		"state":      unit.ActiveState,
 		"sub_state":  unit.SubState,
+		"unit_file": common.MapStr{
+			"state":         props.UnitFileState,
+			"vendor_preset": props.UnitFilePreset,
+		},
 	}
 
 	//most of the properties values are context-dependent.