add dimensions to process data_stream

Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>

packages/system/changelog.yml

@@ -1,7 +1,7 @@
 # newer versions go on top
 - version: "1.28.0"
   changes:
-    - description: Add dimension fields to metrics all data_streams, except core and processor to support TSDS migration
+    - description: Add dimension fields to metrics all data_streams, except core to support TSDS migration
       type: enhancement
       link: https://github.com/elastic/integrations/pull/6118
 - version: "1.27.1"

packages/system/data_stream/process/fields/agent.yml

@@ -13,18 +13,21 @@
 
         Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.'
       example: 666777888999
+      dimension: true
     - name: availability_zone
       level: extended
       type: keyword
       ignore_above: 1024
       description: Availability zone in which this host is running.
       example: us-east-1c
+      dimension: true
     - name: instance.id
       level: extended
       type: keyword
       ignore_above: 1024
       description: Instance ID of the host machine.
       example: i-1234567890abcdef0
+      dimension: true
     - name: instance.name
       level: extended
       type: keyword
@@ -42,12 +45,14 @@
       ignore_above: 1024
       description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
       example: aws
+      dimension: true
     - name: region
       level: extended
       type: keyword
       ignore_above: 1024
       description: Region in which this host is running.
       example: us-east-1
+      dimension: true
     - name: project.id
       type: keyword
       description: Name of the project in Google Cloud.
@@ -67,6 +72,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique container id.
+      dimension: true
     - name: image.name
       level: extended
       type: keyword
@@ -134,6 +140,7 @@
       level: core
       type: keyword
       ignore_above: 1024
+      dimension: true
       description: 'Name of the host.
 
         It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.'
@@ -202,6 +209,13 @@
   description: Process metrics.
   type: group
   fields:
+    - name: pid
+      level: core
+      type: long
+      ignore_above: 1024
+      description: 'Process id.'
+      dimension: true
+
     - name: state
       type: keyword
       description: >

packages/system/data_stream/process/fields/ecs.yml

@@ -48,3 +48,6 @@
   external: ecs
 - name: service.type
   external: ecs
+- external: ecs
+  name: agent.id
+  dimension: true

packages/system/docs/README.md

@@ -1800,6 +1800,7 @@ If running as less privileged user, it may not be able to read process data belo
 | Field | Description | Type | Unit | Metric Type |
 |---|---|---|---|---|
 | @timestamp | Event timestamp. | date |  |  |
+| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword |  |  |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |  |  |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |  |  |
 | cloud.image.id | Image ID for the cloud instance. | keyword |  |  |
@@ -1826,7 +1827,7 @@ If running as less privileged user, it may not be able to read process data belo
 | host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword |  |  |
 | host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword |  |  |
 | host.ip | Host ip addresses. | ip |  |  |
-| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |  |  |
+| host.mac | Host mac addresses. | keyword |  |  |
 | host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword |  |  |
 | host.os.build | OS build information. | keyword |  |  |
 | host.os.codename | OS codename, if any. | keyword |  |  |
@@ -1835,7 +1836,7 @@ If running as less privileged user, it may not be able to read process data belo
 | host.os.full.text | Multi-field of `host.os.full`. | match_only_text |  |  |
 | host.os.kernel | Operating system kernel version as a raw string. | keyword |  |  |
 | host.os.name | Operating system name, without the version. | keyword |  |  |
-| host.os.name.text | Multi-field of `host.os.name`. | text |  |  |
+| host.os.name.text | Multi-field of `host.os.name`. | match_only_text |  |  |
 | host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword |  |  |
 | host.os.version | Operating system version as a raw string. | keyword |  |  |
 | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword |  |  |