elasticsearch: document Metricbeat 8.19+ dependency for index mode and codec

packages/elasticsearch/_dev/build/docs/README.md

@@ -87,6 +87,8 @@ ingest-time enrichment.
 
 ### Index
 
+The `index` metricset is collected by Metricbeat. From package version 1.22.0, the `elasticsearch.index.mode` and `elasticsearch.index.codec` fields are populated when the collecting Metricbeat version includes [beats#49237](https://github.com/elastic/beats/pull/49237) (Metricbeat **8.19** and later). These fields are written to the source indices consumed by the `index_pivot` transform.
+
 {{event "index"}}
 
 {{fields "index"}}
@@ -186,6 +188,10 @@ Other visualizations in the dashboard allow you to compare the relative footprin
 
 Both approaches can be used in conjunction, allowing you to fine-tune ILM on a data stream basis (if required) to closely match usage patterns.
 
+#### Index mode and codec
+
+From package version 1.22.0, the Consumption dashboard and `index_pivot` transform also surface index mode and codec. These values come from `elasticsearch.index.mode` and `elasticsearch.index.codec` in the Metricbeat `index` metricset events that the transform reads from (`metrics-elasticsearch.stack_monitoring.index*`, `.monitoring-es-*`, or `metricbeat-*`). Collecting agents must run Metricbeat **8.19** or later, which includes [beats#49237](https://github.com/elastic/beats/pull/49237). When the fields are absent from source documents, ingest pipelines normalize them to `standard` and `default` respectively.
+
 ⚠️ Important notes:
 
 * The transform job will process all compatible historical data, which has two implications: 1. if you have pre-8.17.1 data, this will not get picked up by the job and 2. it might take time for "live" data to be available, as the transform job works its way through all documents. You can modify the transform job as you please if need be.

packages/elasticsearch/changelog.yml

@@ -1,7 +1,7 @@
 # newer versions go on top
 - version: "1.22.0"
   changes:
-    - description: Wire index mode and codec through the index_pivot transform, normalize missing values to standard/default in the monitoring_indices and index metrics ingest pipelines, and add dashboard visualizations for index mode and codec adoption
+    - description: Wire index mode and codec through the index_pivot transform, normalize missing values to standard/default in the monitoring_indices and index metrics ingest pipelines, and add dashboard visualizations for index mode and codec adoption. Requires Metricbeat 8.19+ (beats#49237) to collect elasticsearch.index.mode and elasticsearch.index.codec in the index metricset source data.
       type: enhancement
       link: https://github.com/elastic/beats/pull/49237
 - version: "1.21.1"

packages/elasticsearch/data_stream/index/fields/fields.yml

@@ -22,8 +22,10 @@
       type: keyword
     - name: mode
       type: keyword
+      description: Index mode (for example, `standard` or `time_series`). Collected from index settings by Metricbeat 8.19+ ([beats#49237](https://github.com/elastic/beats/pull/49237)).
     - name: codec
       type: keyword
+      description: Index codec (for example, `default` or `best_compression`). Collected from index settings by Metricbeat 8.19+ ([beats#49237](https://github.com/elastic/beats/pull/49237)).
     - name: name
       type: keyword
       dimension: true

packages/elasticsearch/docs/README.md

@@ -893,6 +893,8 @@ An example event for `enrich` looks as following:
 
 ### Index
 
+The `index` metricset is collected by Metricbeat. From package version 1.22.0, the `elasticsearch.index.mode` and `elasticsearch.index.codec` fields are populated when the collecting Metricbeat version includes [beats#49237](https://github.com/elastic/beats/pull/49237) (Metricbeat **8.19** and later). These fields are written to the source indices consumed by the `index_pivot` transform.
+
 An example event for `index` looks as following:
 
 ```json
@@ -1061,10 +1063,10 @@ An example event for `index` looks as following:
 | elasticsearch.cluster.id | Elasticsearch cluster id. | keyword |  |
 | elasticsearch.cluster.name | Elasticsearch cluster name. | keyword |  |
 | elasticsearch.cluster.state.id | Elasticsearch state id. | keyword |  |
-| elasticsearch.index.codec |  | keyword |  |
+| elasticsearch.index.codec | Index codec (for example, `default` or `best_compression`). Collected from index settings by Metricbeat 8.19+ ([beats#49237](https://github.com/elastic/beats/pull/49237)). | keyword |  |
 | elasticsearch.index.creation_date |  | date |  |
 | elasticsearch.index.hidden |  | boolean |  |
-| elasticsearch.index.mode |  | keyword |  |
+| elasticsearch.index.mode | Index mode (for example, `standard` or `time_series`). Collected from index settings by Metricbeat 8.19+ ([beats#49237](https://github.com/elastic/beats/pull/49237)). | keyword |  |
 | elasticsearch.index.name | Index name. | keyword |  |
 | elasticsearch.index.primaries.docs.count |  | long | gauge |
 | elasticsearch.index.primaries.docs.deleted |  | long | gauge |
@@ -2770,6 +2772,10 @@ Other visualizations in the dashboard allow you to compare the relative footprin
 
 Both approaches can be used in conjunction, allowing you to fine-tune ILM on a data stream basis (if required) to closely match usage patterns.
 
+#### Index mode and codec
+
+From package version 1.22.0, the Consumption dashboard and `index_pivot` transform also surface index mode and codec. These values come from `elasticsearch.index.mode` and `elasticsearch.index.codec` in the Metricbeat `index` metricset events that the transform reads from (`metrics-elasticsearch.stack_monitoring.index*`, `.monitoring-es-*`, or `metricbeat-*`). Collecting agents must run Metricbeat **8.19** or later, which includes [beats#49237](https://github.com/elastic/beats/pull/49237). When the fields are absent from source documents, ingest pipelines normalize them to `standard` and `default` respectively.
+
 ⚠️ Important notes:
 
 * The transform job will process all compatible historical data, which has two implications: 1. if you have pre-8.17.1 data, this will not get picked up by the job and 2. it might take time for "live" data to be available, as the transform job works its way through all documents. You can modify the transform job as you please if need be.