elasticsearch: document Metricbeat 8.19+ dependency for index mode and codec

[JohannesMahne]

Summary

Adds documentation for the Metricbeat 8.19+ dependency required to collect elasticsearch.index.mode and elasticsearch.index.codec in the index metricset source data consumed by the index_pivot transform.

Updates:

• _dev/build/docs/README.md and rendered docs/README.md
• changelog.yml
• data_stream/index/fields/fields.yml
• Consumption dashboard intro markdown

Depends on beats#49237 (backported to 8.19).

Merges into feature/es-index-mode-codec-compat for #19520.

Test plan

• elastic-package build

Made with Cursor

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 9bdc698

Failed CI Steps

• Check integrations elasticsearch

History

[github-actions]

TL;DR

The failed Buildkite step is not actionable from the prefetched logs: the available log for Check integrations elasticsearch only contains stack teardown/artifact upload plus exit status 1, not the failing elastic-package sub-step output. Static validation of this PR’s Elasticsearch package changes passes locally, so I don’t see evidence yet that the docs/field/dashboard edits are the root cause.

Remediation

• Retry the Buildkite step, or open the full Buildkite job log and inspect the expanded Package elasticsearch: check groups for the first elastic-package install / elastic-package test error.
• If it fails again, attach or expose the failed build/test-results/*.xml artifact or the full job log around the first error; the current prefetched log is insufficient to trace a source-code fix.

Investigation details

Root Cause

Inconclusive. The job failed while running:

.buildkite/scripts/test_one_package.sh packages/elasticsearch origin/feature/es-index-mode-codec-compat 9bdc69867750d55f2df30a668afd60ab61fa7817

That wrapper runs package check/build, stack startup, install, and stack-backed package tests via .buildkite/scripts/common.sh:1004-1042, but the provided log starts after the stack is already being torn down and does not include the sub-step that returned non-zero.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/44728
• Job/step: Check integrations elasticsearch
• Key log excerpt from /tmp/gh-aw/buildkite-logs/integrations-check-integrations-elasticsearch.txt:95-100:

--- [elasticsearch] failed
^^^ +++
🚨 Error: The command exited with status 1
^^^ +++
user command error: exit status 1

The remaining available lines are artifact upload and cleanup (:101-149), not the original test/install error.

Verification

• Fetched PR commit 9bdc69867750d55f2df30a668afd60ab61fa7817 locally.
• Ran elastic-package check -v in packages/elasticsearch: passed.
• Ran elastic-package build -v in packages/elasticsearch: passed.
• Did not run stack-backed elastic-package install / elastic-package test locally because this environment does not support Docker-in-Docker; those are the likely places where the Buildkite-only failure occurred.

Follow-up

If the retry fails with the same job, the useful artifact is the first error before --- [elasticsearch] failed, not the teardown tail currently available to this workflow.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.