otel(processors): implement PdataProcessor interface for add_kubernetes_metadata

[mauri870]

Proposed commit message

Adds RunPdata to the kubernetes processor and introduces MetadataIndexPdata, which resolves the index key directly from a pcommon.Map. Matchers implementing the new pdataMatcher interface operate natively on the map; others fall back to a lazy ToMapstr conversion. Extracts prepareKubeMetadata, a helper shared by Run and RunPdata.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

How to test this PR locally

go test -count=1 -race ./libbeat/processors/add_kubernetes_metadata/... 2>&1

Related issues

• For [otel] Optimize global processors in collector pipeline #50744.

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[github-actions]

TL;DR

The Windows Win 2025 unit-test job failed in winlogbeat/sys/wineventlog/TestEventIterator before exercising iterator logic: eventlog.Open failed: Access is denied. This failure is unrelated to this PR, whose commit changes only libbeat/processors/add_kubernetes_metadata/*.

Remediation

• Retry the Buildkite job once; this is consistent with a Windows runner event-log permission or stale registry/event-source state issue.
• If it reproduces, verify the Win 2025 runner executes the test with permission to create/open the custom event log and clean up any stale WinEventLogTestGo / wineventlog_test registration before rerunning.

Investigation details

Root Cause

The failing test calls createLog at winlogbeat/sys/wineventlog/iterator_test.go:31. createLog installs the test event source and calls eventlog.Open at winlogbeat/sys/wineventlog/util_test.go:63; that call failed with Windows Access is denied at util_test.go:67, so the test never reached EventIterator assertions.

The PR commit f2ce5a1721ee53b285703419945299def99114f3 changes only four files under libbeat/processors/add_kubernetes_metadata/; it does not touch Winlogbeat or the event-log test setup.

Evidence

• Build: https://buildkite.com/elastic/beats/builds/49415
• Job/step: Winlogbeat: Win 2025 Unit Tests / mage build unitTest
• Key log excerpt: === FAIL: winlogbeat/sys/wineventlog TestEventIterator (0.06s) followed by iterator_test.go:31: eventlog.Open failed: Access is denied.
• The same job completed the other Winlogbeat unit packages successfully; the failure occurred during test setup.

Verification

Not run locally because this failure requires the Windows event-log service and registry permissions.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.