[exporter/elasticsearch] Update ecs mode encoder semconv attributes (#43807)

<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
#### Description
- Add new sem conv resource attributes to the ecs mode encoder
- Add new sem conv record attributes to the ecs mode log and span
encoders
* I created a separate
[issue](#43806)
to update the otel version since some attributes added in this PR are
not present in v1.22.0

<!-- Issue number (e.g. #1234) or full URL to issue, if applicable. -->
#### Link to tracking issue
Fixes
#43805

<!--Describe what testing was performed and which tests were added.-->
#### Testing
- Updated unit test 
- Setup a local collector with the elasticsearch exporter to validate
indexed documents

Author: isaacaflores2

.chloggen/es-exporter-update-semconv-maps.yaml

@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern, (e.g. receiver/filelog)
+component: exporter/elasticsearch
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Update Elasticsearch exporter ECS mapping mode encoder semantic convention mappings
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [43805]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user]

exporter/elasticsearchexporter/model.go

@@ -42,13 +42,18 @@ var resourceAttrsConversionMap = map[string]string{
 	string(semconv.ContainerImageTagsKey):     "container.image.tag",
 	string(semconv.HostNameKey):               "host.hostname",
 	string(semconv.HostArchKey):               "host.architecture",
+	string(semconv.ProcessParentPIDKey):       "process.parent.pid",
+	string(semconv.ProcessExecutableNameKey):  "process.title",
 	string(semconv.ProcessExecutablePathKey):  "process.executable",
+	string(semconv.ProcessCommandLineKey):     "process.args",
 	string(semconv.ProcessRuntimeNameKey):     "service.runtime.name",
 	string(semconv.ProcessRuntimeVersionKey):  "service.runtime.version",
 	string(semconv.OSNameKey):                 "host.os.name",
 	string(semconv.OSTypeKey):                 "host.os.platform",
 	string(semconv.OSDescriptionKey):          "host.os.full",
 	string(semconv.OSVersionKey):              "host.os.version",
+	string(semconv.ClientAddressKey):          "client.ip",
+	string(semconv.SourceAddressKey):          "source.ip",
 	string(semconv.K8SDeploymentNameKey):      "kubernetes.deployment.name",
 	string(semconv.K8SNamespaceNameKey):       "kubernetes.namespace",
 	string(semconv.K8SNodeNameKey):            "kubernetes.node.name",
@@ -61,6 +66,8 @@ var resourceAttrsConversionMap = map[string]string{
 	string(semconv.K8SDaemonSetNameKey):       "kubernetes.daemonset.name",
 	string(semconv.K8SContainerNameKey):       "kubernetes.container.name",
 	string(semconv.K8SClusterNameKey):         "orchestrator.cluster.name",
+	string(semconv.FaaSInstanceKey):           "faas.id",
+	string(semconv.FaaSTriggerKey):            "faas.trigger.type",
 }
 
 // resourceAttrsToPreserve contains conventions that should be preserved in ECS mode.
@@ -199,11 +206,12 @@ func (ecsModeEncoder) encodeLog(
 
 	// Finally, try to map record-level attributes to ECS fields.
 	recordAttrsConversionMap := map[string]string{
-		"event.name":                           "event.action",
-		string(semconv.ExceptionMessageKey):    "error.message",
-		string(semconv.ExceptionStacktraceKey): "error.stacktrace",
-		string(semconv.ExceptionTypeKey):       "error.type",
-		string(semconv.ExceptionEscapedKey):    "event.error.exception.handled",
+		"event.name":                            "event.action",
+		string(semconv.ExceptionMessageKey):     "error.message",
+		string(semconv.ExceptionStacktraceKey):  "error.stacktrace",
+		string(semconv.ExceptionTypeKey):        "error.type",
+		string(semconv.ExceptionEscapedKey):     "event.error.exception.handled",
+		string(semconv.HTTPResponseBodySizeKey): "http.response.encoded_body_size",
 	}
 	encodeAttributesECSMode(&document, record.Attributes(), recordAttrsConversionMap, resourceAttrsToPreserve)
 	addDataStreamAttributes(&document, "", idx)
@@ -247,7 +255,12 @@ func (ecsModeEncoder) encodeSpan(
 
 	// Finally, try to map record-level attributes to ECS fields.
 	spanAttrsConversionMap := map[string]string{
-		// None at the moment
+		string(semconv.MessagingDestinationNameKey): "span.message.queue.name",
+		"messaging.operation.name":                  "span.action",
+		string(semconv.DBSystemKey):                 "span.db.type",
+		"db.namespace":                              "span.db.instance",
+		"db.query.text":                             "span.db.statement",
+		string(semconv.HTTPResponseBodySizeKey):     "http.response.encoded_body_size",
 	}
 
 	// Handle special cases.

exporter/elasticsearchexporter/model_test.go

@@ -458,9 +458,20 @@ func TestEncodeSpanECSMode(t *testing.T) {
 		string(semconv.ServiceInstanceIDKey):     "23",
 		string(semconv.ServiceNameKey):           "some-service",
 		string(semconv.ServiceVersionKey):        "env-version-1234",
+		string(semconv.ProcessParentPIDKey):      "42",
+		string(semconv.ProcessExecutableNameKey): "node",
+		string(semconv.ClientAddressKey):         "12.53.12.1",
+		string(semconv.SourceAddressKey):         "12.53.12.1",
+		string(semconv.FaaSInstanceKey):          "arn:aws:lambda:us-east-2:123456789012:function:custom-runtime",
+		string(semconv.FaaSTriggerKey):           "api-gateway",
 	})
 	require.NoError(t, err)
 
+	// add slice attributes
+	processCommandLineSlice := resource.Attributes().PutEmptySlice(string(semconv.ProcessCommandLineKey))
+	err = processCommandLineSlice.FromRaw([]any{"node", "app.js"})
+	require.NoError(t, err)
+
 	scope := pcommon.NewInstrumentationScope()
 
 	traces := ptrace.NewTraces()
@@ -470,6 +481,16 @@ func TestEncodeSpanECSMode(t *testing.T) {
 	scope.CopyTo(scopeSpans.Scope())
 
 	span := scopeSpans.Spans().AppendEmpty()
+	err = span.Attributes().FromRaw(map[string]any{
+		string(semconv.MessagingDestinationNameKey): "users_queue",
+		"messaging.operation.name":                  "receive",
+		string(semconv.DBSystemKey):                 "sql",
+		"db.namespace":                              "users",
+		"db.query.text":                             "SELECT * FROM users WHERE user_id=?",
+		string(semconv.HTTPResponseBodySizeKey):     "http.response.encoded_body_size",
+	})
+	require.NoError(t, err)
+
 	span.SetName("client span")
 	span.SetSpanID([8]byte{0x19, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26})
 	span.SetTraceID([16]byte{1, 2, 3, 4, 5, 6, 7, 8, 8, 7, 6, 5, 4, 3, 2, 1})
@@ -509,6 +530,15 @@ func TestEncodeSpanECSMode(t *testing.T) {
 	  "span": {
 		"id": "1920212223242526",
 		"name": "client span",
+		"action": "receive",
+		"db": {
+		  "instance": "users",
+		  "statement": "SELECT * FROM users WHERE user_id=?",
+		  "type": "sql"
+		},
+		"message": {
+		  "queue": { "name": "users_queue" }
+		},
 		"links": [
 		  {
 			"span_id": "1112131415161718",
@@ -539,6 +569,26 @@ func TestEncodeSpanECSMode(t *testing.T) {
 		  "name": "23"
 		},
 		"version": "env-version-1234"
+	  },
+	  "process": {
+		"parent": { "pid": "42" },
+		"title": "node",
+		"args" : ["node", "app.js"]
+	  },
+	  "client": {
+		"ip": "12.53.12.1"
+      },
+	  "source": {
+		"ip": "12.53.12.1"
+      },
+	  "faas": {
+		"id" : "arn:aws:lambda:us-east-2:123456789012:function:custom-runtime",
+		"trigger": { "type": "api-gateway" }
+	  },
+	  "http": {
+		"response": {
+		  "encoded_body_size": "http.response.encoded_body_size"
+		}
 	  }
 	}`, buf.String())
 }
@@ -591,6 +641,12 @@ func TestEncodeLogECSMode(t *testing.T) {
 		string(semconv.K8SDaemonSetNameKey):      "daemonset.name",
 		string(semconv.K8SContainerNameKey):      "container.name",
 		string(semconv.K8SClusterNameKey):        "cluster.name",
+		string(semconv.ProcessParentPIDKey):      "42",
+		string(semconv.ProcessExecutableNameKey): "node",
+		string(semconv.ClientAddressKey):         "12.53.12.1",
+		string(semconv.SourceAddressKey):         "12.53.12.1",
+		string(semconv.FaaSInstanceKey):          "arn:aws:lambda:us-east-2:123456789012:function:custom-runtime",
+		string(semconv.FaaSTriggerKey):           "api-gateway",
 	})
 	require.NoError(t, err)
 
@@ -602,7 +658,8 @@ func TestEncodeLogECSMode(t *testing.T) {
 
 	record := plog.NewLogRecord()
 	err = record.Attributes().FromRaw(map[string]any{
-		"event.name": "user-password-change",
+		"event.name":                            "user-password-change",
+		string(semconv.HTTPResponseBodySizeKey): 1024,
 	})
 	require.NoError(t, err)
 	observedTimestamp := pcommon.Timestamp(1710273641123456789)
@@ -655,8 +712,10 @@ func TestEncodeLogECSMode(t *testing.T) {
 		},
 		"process": {
 		  "pid": 9833,
-		  "command_line": "/usr/bin/ssh -l user 10.0.0.16",
-		  "executable": "/usr/bin/ssh"
+		  "args": "/usr/bin/ssh -l user 10.0.0.16",
+		  "executable": "/usr/bin/ssh",
+          "parent": { "pid": "42" },
+		   "title": "node"
 		},
 		"service": {
 		  "name": "foo.bar",
@@ -676,6 +735,7 @@ func TestEncodeLogECSMode(t *testing.T) {
 		  "manufacturer": "Samsung"
 		},
 		"event": {"action": "user-password-change"},
+		"http": { "response": {"encoded_body_size": 1024 }} ,
 		"kubernetes": {
 		  "namespace": "default",
 		  "node": {"name": "node-1"},
@@ -691,7 +751,17 @@ func TestEncodeLogECSMode(t *testing.T) {
 		  "daemonset": {"name": "daemonset.name"},
 		  "container": {"name": "container.name"}
 		},
-		"orchestrator": {"cluster": {"name": "cluster.name"}}
+		"orchestrator": {"cluster": {"name": "cluster.name"}},
+        "client": {
+			"ip": "12.53.12.1"
+		},
+        "source": {
+			"ip": "12.53.12.1"
+		},
+        "faas": {
+		    "id" : "arn:aws:lambda:us-east-2:123456789012:function:custom-runtime",
+		     "trigger": { "type": "api-gateway" }
+	  }
 	}`, buf.String())
 }