[elasticsearch] Add security_stats data stream

[ebarlas]

Proposed commit message

Surface per-node security statistics from the Elasticsearch Security
Stats API (GET /_security/stats, available in ES 9.2+) through Stack
Monitoring. The first metric group is the Document Level Security
(DLS) bitset cache: entries, memory, hits, misses, evictions, and
hit/miss latency.

The data stream mirrors the existing X-Pack per-node metrics streams
(ccr, enrich): identical base-fields, ecs, and agent stream config,
plus the same manifest shape. The field schema and sample event are
transcribed from the merged Metricbeat security_stats metricset
(elastic/beats#50674), which the agent runs to collect the data.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices (N/A: no dashboards in this PR)

Author's Checklist

• Confirm the package version bump (1.22.0) is correct relative to the concurrently landed querylog data stream (1.21.0/1.21.1).
• Confirm CI runs the security_stats system test on a stack whose agent contains the metricset (9.3.5+/9.4.2+/9.5.0+). On older agents the system test will collect zero documents and fail, so a version guard may be needed.
• Confirm whether the changelog and docs should spell out the Agent 9.3.5+/9.4.2+ collection floor in addition to the ES 9.2 endpoint floor.

How to test this PR locally

This data stream requires an Elastic Agent build that contains the security_stats metricset (9.3.5+, 9.4.2+, or 9.5.0+). Older agents will collect nothing.

# from the repo root
elastic-package stack up -d --version 9.5.0-SNAPSHOT

cd packages/elasticsearch
elastic-package check
elastic-package test system --data-streams security_stats -v

elastic-package stack down

A bare, security-enabled cluster reports the DLS bitset cache block with zero-valued counters, so the system test collects and validates documents without any DLS role/query fixture. This PR was validated with elastic-package check and a passing elastic-package test system on a 9.5.0-SNAPSHOT stack.

Related issues

• Closes [elasticsearch] Add security_stats data stream (DLS bitset cache, ES 9.2+) #18680
• Relates [Metricbeat] Add elasticsearch/security_stats metricset beats#50674

Screenshots

N/A. This PR adds a data stream and its field schema only; no dashboards or configuration UI changes are included.

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[pickypg]

LGTM with simple suggestions to make testing easier and perhaps a little more lighter and more predictable.

[pickypg]

Do we need 1g instead of 512m?

[ebarlas]

Tested with 512m and applied change in commit aea224c

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package elasticsearch 👍(2) 💚(3) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
server	5988.02	3773.58	-2214.44 (-36.98%)	💔

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: aea224c

History

• 💔 Build #45424 failed a37644d
• 💔 Build #45418 failed 18509fa

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[ebarlas]

@pickypg , the "Check integrations elasticsearch" job was failing[1] since CI ran the package's system tests against stack 8.10.1. As a result, I added a skip configuration[2] in commit aea224c.

Is this an appropriate resolution? Is it possible to raise the stack version instead?

---

FAIL: elasticsearch/security_stats/default (variant: elasticsearch_9.2.0) (system)
    test case failed: could not find the expected hits in metrics-elasticsearch.stack_monitoring.security_stats-42952 data stream

skip:
  reason: "security_stats metricset requires Elastic Agent 9.3.5+/9.4.2+/9.5.0+; package CI runs the minimum supported stack (8.10.1) where the metricset is absent"
  link: https://github.com/elastic/integrations/issues/18680