elasticsearch.node.stats.indices.shard_stats.total_count missing in ES monitoring template

[renshuki]

Description

The elasticsearch.node.stats.indices.shard_stats.total_count is missing in the monitoring-es-mb.json template.
It was originally added added to the Elasticsearch module (Beats) via elastic/beats#38891.

I can see there was this PR (#107471) and the ES side to add the field to the monitor mappings. However, I can see it was added as cluster_stats.indices.shards_stats.total_count, not elasticsearch.node.stats.indices.shard_stats.total_count. Is it a mistake?

I don't see this field being used anywhere in the monitoring data.

Nonetheless elasticsearch.node.stats.indices.shard_stats.total_count need to be added so it can be used to create some alerts (i.e. Kibana Alerting).

[consulthys]

I can see there was this PR (#107471) and the ES side to add the field to the monitor mappings. However, I can see it was added as cluster_stats.indices.shards_stats.total_count, not elasticsearch.node.stats.indices.shard_stats.total_count. Is it a mistake?

@philippkahr I guess this question is for you, would you mind providing some context on it?

[renshuki]

Metricbeat - Exported fields - Elasticsearch Fields for reference, where elasticsearch.node.stats.indices.shard_stats.total_count is in the list. cluster_stats.indices.shards_stats.total_count is not present.

[elasticsearchmachine]

Pinging @elastic/es-data-management (Team:Data Management)