[BUG][AWS] EC2 Instance metadata not populated as identifier is not matched

[MichaelKatsoulis]

Bug Summary

A regression in cloudwatch.createEvents now prefixes the account ID into eventIdentifier for EC2 metrics.
ec2.AddMetadata still derives the instance ID by splitting the identifier and removing only the last segment, so it ends up with accountId-instanceId instead of instanceId. As a result, it fails to match any EC2 instances and stops populating aws.ec2.instance.state.name.

This was introduced by changes in https://github.com/elastic/beats/pull/46978/changes

---

Where the regression was introduced

In cloudwatch/cloudwatch.go, identifier creation changed:

beats/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go

Line 585 in 5e6d503

identifierValue := labels[aws.LabelConst.AccountIdIdx] + "-" + labels[aws.LabelConst.IdentifierValueIdx] + fmt.Sprint("-", valI)

identifierValue := labels[aws.LabelConst.AccountIdIdx] + "-" + labels[aws.LabelConst.IdentifierValueIdx] + fmt.Sprint("-", valI)

This makes identifiers look like:

123456789012-i-0abcd1234-0

But metadata expects:

beats/x-pack/metricbeat/module/aws/cloudwatch/metadata/ec2/ec2.go

Line 38 in 5e6d503

eventIdentifierComponents := strings.Split(eventIdentifier, "-")

i-0abcd1234-0

---

Impact

• ec2.AddMetadata can no longer match instance IDs
• aws.ec2.instance.state.name (and other EC2 metadata fields) stop being populated

---

Possible Fix

We could either use aws.dimensions.InstanceId directly when matching:

if dimInstanceID, err := events[eventIdentifier].RootFields.GetValue("aws.dimensions.InstanceId"); err == nil {
    instanceID := dimInstanceID.(string)
    // use instanceID instead of parsing eventIdentifier
}

or just strip the account ID prefix when present before matching.

[elasticmachine]

Pinging @elastic/obs-ds-hosted-services (Team:obs-ds-hosted-services)