Move labels and annotations under kubernetes.namespace.

CHANGELOG.next.asciidoc

@@ -23,6 +23,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Remove deprecated/undocumented IncludeCreatorMetadata setting from kubernetes metadata config options {pull}28006[28006]
 - Remove deprecated fields from kubernetes module {pull}28046[28046]
 - Remove deprecated config option aws_partition. {pull}28120[28120]
+- Update kubernetes.namespace from keyword to group field and add name, labels, annotations, uuid as its fields {pull}27917[27917]
 
 *Auditbeat*
 

auditbeat/docs/fields.asciidoc

@@ -17322,16 +17322,47 @@ type: ip
 
 --
 
-*`kubernetes.namespace`*::
+
+*`kubernetes.namespace.name`*::
 +
 --
-Kubernetes namespace
+Kubernetes namespace name
 
 
 type: keyword
 
 --
 
+*`kubernetes.namespace.uuid`*::
++
+--
+Kubernetes namespace uuid
+
+
+type: keyword
+
+--
+
+*`kubernetes.namespace.labels.*`*::
++
+--
+Kubernetes namespace labels map
+
+
+type: object
+
+--
+
+*`kubernetes.namespace.annotations.*`*::
++
+--
+Kubernetes namespace annotations map
+
+
+type: object
+
+--
+
 *`kubernetes.node.name`*::
 +
 --

filebeat/docs/fields.asciidoc

@@ -85721,16 +85721,47 @@ type: ip
 
 --
 
-*`kubernetes.namespace`*::
+
+*`kubernetes.namespace.name`*::
 +
 --
-Kubernetes namespace
+Kubernetes namespace name
 
 
 type: keyword
 
 --
 
+*`kubernetes.namespace.uuid`*::
++
+--
+Kubernetes namespace uuid
+
+
+type: keyword
+
+--
+
+*`kubernetes.namespace.labels.*`*::
++
+--
+Kubernetes namespace labels map
+
+
+type: object
+
+--
+
+*`kubernetes.namespace.annotations.*`*::
++
+--
+Kubernetes namespace annotations map
+
+
+type: object
+
+--
+
 *`kubernetes.node.name`*::
 +
 --

heartbeat/docs/fields.asciidoc

@@ -14904,16 +14904,47 @@ type: ip
 
 --
 
-*`kubernetes.namespace`*::
+
+*`kubernetes.namespace.name`*::
 +
 --
-Kubernetes namespace
+Kubernetes namespace name
 
 
 type: keyword
 
 --
 
+*`kubernetes.namespace.uuid`*::
++
+--
+Kubernetes namespace uuid
+
+
+type: keyword
+
+--
+
+*`kubernetes.namespace.labels.*`*::
++
+--
+Kubernetes namespace labels map
+
+
+type: object
+
+--
+
+*`kubernetes.namespace.annotations.*`*::
++
+--
+Kubernetes namespace annotations map
+
+
+type: object
+
+--
+
 *`kubernetes.node.name`*::
 +
 --

journalbeat/docs/fields.asciidoc

@@ -15249,16 +15249,47 @@ type: ip
 
 --
 
-*`kubernetes.namespace`*::
+
+*`kubernetes.namespace.name`*::
 +
 --
-Kubernetes namespace
+Kubernetes namespace name
 
 
 type: keyword
 
 --
 
+*`kubernetes.namespace.uuid`*::
++
+--
+Kubernetes namespace uuid
+
+
+type: keyword
+
+--
+
+*`kubernetes.namespace.labels.*`*::
++
+--
+Kubernetes namespace labels map
+
+
+type: object
+
+--
+
+*`kubernetes.namespace.annotations.*`*::
++
+--
+Kubernetes namespace annotations map
+
+
+type: object
+
+--
+
 *`kubernetes.node.name`*::
 +
 --

libbeat/autodiscover/providers/kubernetes/pod.go

@@ -186,7 +186,8 @@ func (p *pod) GenerateHints(event bus.Event) bus.Event {
 		}
 
 		// Look at all the namespace level default annotations and do a merge with priority going to the pod annotations.
-		if rawNsAnn, ok := kubeMeta["namespace_annotations"]; ok {
+		rawNsAnn, err := kubeMeta.GetValue("namespace.annotations")
+		if err == nil {
 			namespaceAnnotations, _ := rawNsAnn.(common.MapStr)
 			if len(namespaceAnnotations) != 0 {
 				annotations.DeepUpdateNoOverwrite(namespaceAnnotations)
@@ -381,7 +382,7 @@ func (p *pod) containerPodEvents(flag string, pod *kubernetes.Pod, c *containerI
 		"runtime": c.runtime,
 	}
 	if len(namespaceAnnotations) != 0 {
-		kubemeta["namespace_annotations"] = namespaceAnnotations
+		kubemeta.Put("namespace.annotations", namespaceAnnotations)
 	}
 
 	ports := c.spec.Ports
@@ -433,7 +434,7 @@ func (p *pod) podEvent(flag string, pod *kubernetes.Pod, ports common.MapStr, in
 	kubemeta = kubemeta.Clone()
 	kubemeta["annotations"] = annotations
 	if len(namespaceAnnotations) != 0 {
-		kubemeta["namespace_annotations"] = namespaceAnnotations
+		kubemeta.Put("namespace.annotations", namespaceAnnotations)
 	}
 
 	// Don't set a port on the event