metricbeat: add integration TestIndexTotalFieldsLimitNotReached

[AndersonQ]

Proposed commit message

metricbeat: add integration TestIndexTotalFieldsLimitNotReached

The new integration test TestIndexTotalFieldsLimitNotReached ensures events with at least 500 new dynamically mapped fields can be ingested.

This new test will start failing when the metricbeat mapping has increased to the point it isn't possible to add a new event with 500 dynamically mapped fields. It should act as a safe guard to prevent us from releasing a version where the static mapping is too close to the total fields limit.

Checklist

• [x] My code follows the style guidelines of this project
• [ ] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] I have made corresponding change to the default configuration files
• [x] I have added tests that prove my fix is effective or that my feature works
• [ ] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

• N/A

How to test this PR locally

• build x-pack/metricbeat
  • cd x-pack/metricbeat
  • go build .
• adjust metricbeat.yml to point to your stack and make sure to include setup.kibana.host
• run ./metricbeat setup
• generate an event with 500 dynamic fields. Just use the same for loop the test uses
• ingest the event:

  POST metricbeat-9.0.0/_doc
  { 
  ...
  }

• it should succeed
• change the index.mapping.total_fields.limit for the metricbeat index template:
  • go to your-kibna/app/management/data/index_management/templates/metricbeat-9.0.0
  • metricbeat-9.0.0 > Manage > Edit > 3 Index settings
  • change index.mapping.total_fields.limit to 10000:

    "mapping": {
    "total_fields": {
    "limit": "10000"
    }

• rollover the index

  POST metricbeat-9.0.0/_rollover

• try to ingest the same event again, you should get an error like:

  {
  "error": {
  "root_cause": [
    {
      "type": "document_parsing_exception",
      "reason": "[1:378] failed to parse: Limit of total fields [10000] has been exceeded while adding new fields [11]"
    }
  ],
  "type": "document_parsing_exception",
  "reason": "[1:378] failed to parse: Limit of total fields [10000] has been exceeded while adding new fields [11]",
  "caused_by": {
    "type": "illegal_argument_exception",
    "reason": "Limit of total fields [10000] has been exceeded while adding new fields [11]"
  },
  "failure_store": "not_enabled"
  },
  "status": 400
  }

Related issues

• Relates https://github.com/elastic/beats/pull/41614

[mergify[bot]]

This pull request does not have a backport label. If this is a bug or security fix, could you label this PR @AndersonQ? 🙏. For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit

[mergify[bot]]

backport-8.x has been added to help with the transition to the new branch 8.x. If you don't need it please use backport-skip label and remove the backport-8.x label.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)