Add source field in k8s events (elastic#17209)

CHANGELOG.next.asciidoc

@@ -209,6 +209,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add custom string mapping to CEF module to support Check Point devices. {issue}16041[16041] {pull}16907[16907]
 - Add pattern for Cisco ASA / FTD Message 734001 {issue}16212[16212] {pull}16612[16612]
 - Added new module `o365` for ingesting Office 365 management activity API events. {issue}16196[16196] {pull}16386[16386]
+- Add source field in k8s events {pull}17209[17209]
 - Improve AWS cloudtrail field mappings {issue}16086[16086] {issue}16110[16110] {pull}17155[17155]
 - Added documentation for running Filebeat in Cloud Foundry. {pull}17275[17275]
 

metricbeat/docs/fields.asciidoc

@@ -21983,6 +21983,33 @@ type: keyword
 Type of the given event
 
 
+type: keyword
+
+--
+
+[float]
+=== source
+
+The component reporting this event
+
+
+
+*`kubernetes.event.source.component`*::
++
+--
+Component from which the event is generated
+
+
+type: keyword
+
+--
+
+*`kubernetes.event.source.host`*::
++
+--
+Node name on which the event is generated
+
+
 type: keyword
 
 --

metricbeat/module/kubernetes/event/_meta/fields.yml

@@ -33,6 +33,19 @@
     type: keyword
     description: >
       Type of the given event
+  - name: source
+    type: group
+    description: >
+      The component reporting this event
+    fields:
+    - name: component
+      type: keyword
+      description: >
+        Component from which the event is generated
+    - name: host
+      type: keyword
+      description: >
+        Node name on which the event is generated
   - name: metadata
     type: group
     description: >

metricbeat/module/kubernetes/event/event.go

@@ -169,6 +169,10 @@ func generateMapStrFromEvent(eve *kubernetes.Event, dedotConfig dedotConfig) com
 		"reason":  eve.Reason,
 		"type":    eve.Type,
 		"count":   eve.Count,
+		"source": common.MapStr{
+			"host":      eve.Source.Host,
+			"component": eve.Source.Component,
+		},
 		"involved_object": common.MapStr{
 			"api_version":      eve.InvolvedObject.APIVersion,
 			"resource_version": eve.InvolvedObject.ResourceVersion,

metricbeat/module/kubernetes/event/event_test.go

@@ -73,6 +73,11 @@ func TestGenerateMapStrFromEvent(t *testing.T) {
 		"prometheus_io/scrape": "false",
 	}
 
+	source := v1.EventSource{
+		Component: "kubelet",
+		Host:      "prod_1",
+	}
+
 	testCases := map[string]struct {
 		mockEvent        v1.Event
 		expectedMetadata common.MapStr
@@ -84,6 +89,7 @@ func TestGenerateMapStrFromEvent(t *testing.T) {
 					Labels:      labels,
 					Annotations: annotations,
 				},
+				Source: source,
 			},
 			expectedMetadata: common.MapStr{
 				"labels":      expectedLabelsMapStrWithDot,
@@ -100,6 +106,7 @@ func TestGenerateMapStrFromEvent(t *testing.T) {
 					Labels:      labels,
 					Annotations: annotations,
 				},
+				Source: source,
 			},
 			expectedMetadata: common.MapStr{
 				"labels":      expectedLabelsMapStrWithDeDot,
@@ -116,6 +123,7 @@ func TestGenerateMapStrFromEvent(t *testing.T) {
 					Labels:      labels,
 					Annotations: annotations,
 				},
+				Source: source,
 			},
 			expectedMetadata: common.MapStr{
 				"labels":      expectedLabelsMapStrWithDot,
@@ -132,6 +140,7 @@ func TestGenerateMapStrFromEvent(t *testing.T) {
 					Labels:      labels,
 					Annotations: annotations,
 				},
+				Source: source,
 			},
 			expectedMetadata: common.MapStr{
 				"labels":      expectedLabelsMapStrWithDeDot,
@@ -149,6 +158,8 @@ func TestGenerateMapStrFromEvent(t *testing.T) {
 			mapStrOutput := generateMapStrFromEvent(&test.mockEvent, test.dedotConfig)
 			assert.Equal(t, test.expectedMetadata["labels"], mapStrOutput["metadata"].(common.MapStr)["labels"])
 			assert.Equal(t, test.expectedMetadata["annotations"], mapStrOutput["metadata"].(common.MapStr)["annotations"])
+			assert.Equal(t, source.Host, mapStrOutput["source"].(common.MapStr)["host"])
+			assert.Equal(t, source.Component, mapStrOutput["source"].(common.MapStr)["component"])
 		})
 	}
 }