Move from deprecated container input to filestream

[pebrc]

Fixes #8667

Replace the deprecated container input with a filestream input on the ECK operator StatefulSet/Deployment in both OLM and standalone ECK.

I also noticed that the ~ YAML notation for null did break the configuration when using kubectl apply for some reason that have not dug deep enough to understand. Moving to {} instead led to a working configuration. I therefore also applied this change to the relevant configuration recipes.

I also noticed that the co.elastic.logs/module: elasticsearch annotation is broken in 9.0 but will create a separate issue for that (I don't think it is anything we can fix in ECK tbh)

[prodsecmachine]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

[Copilot]

Pull Request Overview

This PR replaces the deprecated container input with a filestream input for log collection in both the OLM CSV template and the operator StatefulSet, and fixes YAML null notation issues by switching from ~ to {} in various configuration recipes.

• Swap out container-based annotations for filestream in CSV and StatefulSet templates
• Replace all ~ YAML nulls with explicit {} for parser and fingerprint configurations
• Ensure Kubernetes kubectl apply works correctly with updated configs

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
hack/operatorhub/templates/csv.tpl	Updated co.elastic.logs/raw annotation from container to filestream
deploy/eck-operator/templates/statefulset.yaml	Swapped log annotation to filestream and applied YAML null fix
config/recipes/beats/stack_monitoring.yaml	Replaced ~ with {} for container parser and file_identity.fingerprint
config/recipes/beats/openshift_monitoring.yaml	Replaced ~ with {} for container parser and file_identity.fingerprint
config/recipes/beats/filebeat_no_autodiscover.yaml	Replaced ~ with {} for container parser and file_identity.fingerprint
config/recipes/beats/filebeat_autodiscover_by_metadata.yaml	Replaced ~ with {} for container parser and file_identity.fingerprint
config/recipes/beats/filebeat_autodiscover.yaml	Replaced ~ with {} for container parser and file_identity.fingerprint

Comments suppressed due to low confidence (4)

hack/operatorhub/templates/csv.tpl:330

• [nitpick] Consider extracting the repeated JSON annotation into a shared template variable or helper to reduce duplication and simplify future updates.

"co.elastic.logs/raw": "[{\"type\":\"filestream\",...}]"

deploy/eck-operator/templates/statefulset.yaml:28

• Remove the trailing whitespace at the end of this annotation value to prevent unintended spaces in the generated configuration.

"co.elastic.logs/raw": "[{\"type\":\"filestream\",...}]" 

hack/operatorhub/templates/csv.tpl:330

• [nitpick] Add or update a comment explaining the change from container to filestream input, including any version compatibility notes for users.

"co.elastic.logs/raw": "[{\"type\":\"filestream\",...}]"

config/recipes/beats/stack_monitoring.yaml:162

• [nitpick] Consider adding an integration test or CI validation to ensure that replacing ~ with {} in parser configurations is parsed correctly and doesn't break the YAML schema.

- container: {}

[naemono]

buildkite test this

[naemono]

I tested in both 9.0.1, and 7.17.28 and see no issues. lgtm.