…#15449)

- Allow for zero scope fields in options template

NetFlow v9 spec allows for options templates that contain no scope
fields. The netflow input was treating this case as an error and
discarding the template, but that is only applicable to IPFIX.

- Use additional fields to populate bytes/pkt counters

Some devices out there (Cisco NSEL) use fields 231/232 as bytes
counters, when those are supposed to be layer 4 payload counters.

This updates the ECS fields populator to use those fields when the
expected ones are not found.

- Support a classId of 32 bits

While the spec mandates a classId of 8 bits, some Cisco ASA devices
actually use a 32 bit version of this field.

This patches the field to allow up to 32-bit integers and updates the
index pattern to use `long` for the `netflow.class_id` field.

- Add more fields from v9 Cisco devices

Fixes elastic#14212

Co-authored-by: DeDe Morton <dede.morton@elastic.co>

Co-authored-by: Sophia Xu <sophia.xu@elastic.co>

…15545)

* Handle error message in handleS3Objects function

* remove s3Context.Fail and use setError and done instead

* Add changelog

This dashboard wasn't updated after a couple of fields were renamed.

Fixes: elastic#15420

* Add test for publisher queue encode and decode.

* Run mage fmt.

* Fixes from code review.

…ger (elastic#15557)

The conversion failed when for strings with leading zeroes and a decimal
digit 8 or 9, as the underlying runtime function would try to parse that
as an octal number.

This is fixed by only allowing decimal and hex, which in turns makes the
processor more aligned to its Elasticsearch counterpart.

Fixes elastic#15513

This PR adds a new mage target to Functionbeat named `buildPkgForFunction`. It generates the folder `pkg` with the functions to make testing the manager more comfortable during development.

Use of `type: array` in some fields (which was inconsistent) causes
those fields to be excluded from the template. This prevents pointing
aliases to those fields, which we need in 7.6+.

Setting those fields to `keyword` explicitly so that they are included
in the template.

Fixes elastic#15588

…wing a PR (elastic#15388)

* Add a PR template that provides valuable information when reviewing a PR

* Add CLA check

* Fix typo

* Address comments during review

* SF: Fix typo

* Add deprecation as PR type

* Make it clear how to strike through in markdown

* Add default configuration files to the checklist

* Modify cockroachdb source

* Define testdata

* Do not publish ports

* Update docs

* mage fmt update

* Describe containerized environment

* Update CHANGELOG.next.asciidoc

Co-Authored-By: Chris Mark <chrismarkou92@gmail.com>

* Update data.json

* Rename image

* Update source after review

* Filter ibmmq_ metrics

* mage check

* Fix: mage check

* Don't expose port

* Rename status to qmgr

* Add subscriptions overview dashboard for IBM MQ module

* Add calls, messages overview dashboard for IBM MQ module

* Add screenshots

* Fix: mage check

* Fix: CHANGELOG

* Add explanation

* Fix: mage check

Co-authored-by: Chris Mark <chrismarkou92@gmail.com>

* Cleanup changelogs for master
* Remove extra header in CHANGELOG.asciidoc

* Add lambda metricset

* Mask password is string representation of config

* Rename method

* Adding unit test

* Use const for module config password setting name

* Using common.DebugString

* Simplifying

* Removing now-invalid unit test

* Removing now-unnecessary const

* Refactoring: moving debug-related var and func to common file

* Refactoring: rename from black list to mask list

* Implement fmt.Formatter for common.MapStr

* Reintroduce debug statement

* Make MarshalLogObject always filter MapStr object for logging purposes

* Refactoring: renaming to be bit more generic

* Forgot to add license header to new file

* Fixing verb syntax

…ic#15640)

* Adding monitoring.cloud.* settings to reference files

* Missed winlogbeat somehow

* Missed x-pack/winlogbeat

* Fix panic: don't send events if client is nil

* Use mutex

* Add CHANGELOG entry

* Rename changelog entry

* Fix: changelog

* Temporarily use specific logstash release

* Fix changelog

it uses APM pipeline library configured in the instance

* AWS Lambda: downgrade Kibana dashboard

* Downgrade other AWS dashboards

* Log command error if setup dashboards fails

* Another downgrade

From the README of goracle:

> Goracle is deprecated because of naming (trademark) issues.

From now on we are using github.com/godror/godror instead.

… to reuse (elastic#15503)

* Move pdh query to shared location

* Update changelog

* Fix make update

* mage fmt

* fix changelog

Remove datasource option from SQL module. This option was
intended to set the DSN of a database connection, and we were
ignoring the hosts setting. In other SQL modules we are using
the values in hosts as DSNs, do here the same for consistency.
Host is redacted when we cannot parse it as it can contain passwords.

StandardizeEvent is exposed in mbtest.Fetcher interface so we can
more easily check contents of events in tests.

Add integration tests of the module with MySQL and PostgreSQL.

Add real data.json with data from MySQL and PostgreSQL.

…c#15643)

* add service metricset to ref docs

* update xpack docs

* add NaN check to docker/diskio

* return 0

since 7.0 elasticsearch is using java.time style patterns.
YYYY becomes yyyy

* [DOCS] Add missing config options to shared file

* Add fixes from review

* Run mage fmt update to fix build error

…15587)

Allow for multiple status codes in config. Fixes elastic#13595

## What does this PR do?

This PR updates the dependency `github.com/godror/godror` to v0.10.4.

## Why is it important?

Packaging of Metricbeat fails due to the issue in the `godror` version we are currently using. See more about the problem: godror/godror#8

* Collect normalized CPU percentages by default

* Adding CHANGELOG entry

* Updating x-pack/metricbeat