Improve cloud_metadata

Signed-off-by: chrismark <chrismarkou92@gmail.com>

libbeat/processors/add_cloud_metadata/add_cloud_metadata.go

@@ -124,20 +124,35 @@ func (p *addCloudMetadata) Run(event *beat.Event) (*beat.Event, error) {
 	if !p.initData.overwrite {
 		cloudValue, _ := event.GetValue("cloud")
 		if cloudValue != nil {
+			err := p.extractECSMeta(event, meta)
+			if err != nil {
+				return nil, err
+			}
 			return event, nil
 		}
 	}
 
-	err := addMeta(event, meta)
+	err := p.extractECSMeta(event, meta)
+	if err != nil {
+		return nil, err
+	}
+	_, err = event.PutValue("cloud", meta)
 	return event, err
 }
 
 func (p *addCloudMetadata) String() string {
 	return "add_cloud_metadata=" + p.getMeta().String()
 }
 
-func addMeta(event *beat.Event, meta common.MapStr) error {
+func (p *addCloudMetadata) extractECSMeta(event *beat.Event, meta common.MapStr) error {
 	// handle ECS fields first
+	if !p.initData.overwrite {
+		orchestratorValue, _ := event.GetValue("orchestrator")
+		if orchestratorValue != nil {
+			meta.Delete("orchestrator")
+			return nil
+		}
+	}
 	orchestratorFields, err := meta.GetValue("orchestrator")
 	if err == nil {
 		_, err = event.PutValue("orchestrator", orchestratorFields)
@@ -147,7 +162,5 @@ func addMeta(event *beat.Event, meta common.MapStr) error {
 	}
 	meta.Delete("orchestrator")
 
-	// put cloud.* metadata
-	_, err = event.PutValue("cloud", meta)
-	return err
+	return nil
 }

libbeat/processors/add_cloud_metadata/provider_google_gce.go

@@ -109,7 +109,7 @@ var gceMetadataFetcher = provider{
 			} else {
 				out.Delete("orchestrator")
 			}
-			
+
 			if project, ok := m["project"].(map[string]interface{}); ok {
 				s.Schema{
 					"project": s.Object{