[9.5](backport #51679) otel(processors): implement PdataProcessor for add_docker_metadata

[mergify]

Proposed commit message

Adds RunPdata, which enriches a pcommon.Map directly with Docker container metadata. Introduces resolveCIDFromPdata, mirroring Run's three-path CID resolution strategy (log.file.path via sourceProcessor, PID-based cgroup lookup, user-defined match fields) without converting to/from mapstr.M. Parity coverage in TestMatchContainer verifies Run and RunPdata produce identical output.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

How to test this PR locally

go test -count=1 -v ./libbeat/processors/add_docker_metadata/...

Related issues

• For [otel] Optimize global processors in collector pipeline #50744

---

This is an automatic backport of pull request #51679 done by [Mergify](https://mergify.com).

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[github-actions]

TL;DR

The only failure is an unrelated Winlogbeat Windows unit test: winlogbeat/eventlog/TestWindowsEventLogAPI fails while opening the test event log with Access is denied. The PR changes only libbeat/processors/add_docker_metadata, so this does not point to a regression in the PR. Please retry after checking the Windows 2025 agent event-log subscription and privilege configuration.

Remediation

• Retry the failed Winlogbeat: Win 2025 Unit Tests job; if it reproduces, run the test under the same agent identity with permission to subscribe to the custom WinlogbeatTestGo channel and inspect the runner elevation/service-account policy.
• Validate with go test ./winlogbeat/eventlog on the Windows 2025 image after restoring event-log access.

Investigation details

Root Cause

TestWindowsEventLogAPI calls createLog at winlogbeat/eventlog/wineventlog_test.go:167. createLog registers the custom provider and then opens it at winlogbeat/eventlog/wineventlog_test.go:336-341; the failure is reported at line 341 as Access is denied. The underlying reader subscribes to the channel through the Windows Event Log API in winlogbeat/eventlog/wineventlog.go:334-355. The failing test and Winlogbeat event-log implementation are outside this PR's two changed files.

Evidence

• Build: https://buildkite.com/elastic/beats/builds/49370
• Job/step: Winlogbeat: Win 2025 Unit Tests / mage build unitTest
• Key log excerpt: === FAIL: winlogbeat/eventlog TestWindowsEventLogAPI (0.08s), followed by wineventlog_test.go:341: Access is denied.

Verification

• The log shows all other Winlogbeat packages passed; 210 tests ran with 1 failure.
• Reviewed PR [9.5](backport #51679) otel(processors): implement PdataProcessor for add_docker_metadata #51916 diff: changes are confined to libbeat/processors/add_docker_metadata/add_docker_metadata.go and add_docker_metadata_test.go; no Winlogbeat files are modified.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[mauri870]

/test