Fix autodiscover for docker in filebeat

[kaiyan-sheng]

This PR is based on #10758

Results from autodiscover for docker with filebeat have docker.container.id fields instead of the ECS fields container.id.

Turned out the container information in filebeat output came from docker autodiscover. Without dedot in autodiscover, labels in output json will not be dedotted. If processor add_docker_metadata is enabled, then the labels in json output will be duplicated: one set of labels without dedotting (from autodiscover) and another set of labels after dedotting (from add_docker_metadata).

Please see results in pictures below.

1. With add_docker_metadata labels.dedot=true but no dedot for autodiscover (docker.autodiscover labels.dedot=false):

You can see same labels showed up twice, once with dots and the other without.

2. With docker.autodiscover labels.dedot=true:

You can see there is no duplicate labels.

[kaiyan-sheng]

@jsoriano I think this is ready for review :-) Seems like we do need to add dedot in docker autodiscover after all. Otherwise when https://github.com/elastic/beats/blob/master/libbeat/processors/add_docker_metadata/add_docker_metadata.go#L188 happens, the labels will get both the dedotted version and the original version with dots. Please correct me if this doesn't make sense to you at all.... I'm still trying to figure out the inner connections :-) Thanks!

[jsoriano]

@kaiyan-sheng thanks for doing this, I have been testing it and I found that dedotting was being applied to selectors, so conditions on labels with dots stopped working, as well as hints with dots. I am continuing with #10898 to address these issues.

I have opened also a backport (#10899) so dedotting of autodiscover labels is available also in 6.7, but disabled by default.

[jsoriano]

Merged as part of #10898

[ainiml]

@jsoriano I think this is ready for review :-) Seems like we do need to add dedot in docker autodiscover after all

Both labels.dedot and templates are required for autodiscovery to work, but the template should not be needed if you just want to gather all docker containers, and want to use autodiscover to add the docker metadata

 filebeat.autodiscover:
   providers:
     - type: docker
       labels.dedot: true
       templates:
         - condition:
           contains:
             docker.container.name: "*"
           config:
             - type: docker
               containers.ids:
                 - "${data.docker.container.id}"

[jsoriano]

@ainiml for this case you can use hints-based autodiscover, with the advantage of being able to add fine-grained configuration to specific pods and containers if you need it.

[ainiml]

@jsoriano thanks! Going with the least effort was the initial goal, just to get enough information into logstash to do some filtering