perf: combined processor allocation optimizations (do not merge)

[strawgate]

Combined performance PR (do not merge)

This PR combines all three processor allocation optimization PRs into a single branch for unified benchmarking and profiling. Each commit corresponds to one PR:

1. perf: remove unnecessary allocations in hot-path processors (perf: remove unnecessary allocations in hot-path processors #49761) — Remove wasteful Clone() calls in docker metadata, kubernetes metadata, timestamp, and publisher/processing.
2. perf: use DeepCopyUpdate to eliminate Clone+DeepUpdate allocations ([DNM] perf: use DeepCopyUpdate to eliminate Clone+DeepUpdate allocations #49762) — Single-pass DeepCopyUpdate in add_fields, cloud/host/observer metadata, rename, processing, and heartbeat. Depends on feat(mapstr): add DeepCopyUpdate for single-pass clone+merge elastic-agent-libs#390.
3. perf: skip unnecessary event.Clone() in processors (perf: skip unnecessary event.Clone() in processors for single-field ops #49777) — Eliminate event.Clone() in dissect (check-then-write) and 10 other single-field processors.

Merge via individual PRs

Do not merge this PR directly. Merge the individual PRs above instead — they have full descriptions, benchmark data, and test plans.

🤖 Generated with Claude Code

[botelastic]

This pull request doesn't have a Team:<team> label.

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @strawgate? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds many tests and benchmarks across libbeat and implements behavioral and performance changes: expanded Event.DeepUpdate tests/benchmarks; add_fields fast-paths and corresponding tests/benchmarks; add_cloud_metadata per-value cloning and tests/benchmarks; host metadata cache rewritten for atomic timestamp + lock-free fast path and tests; kubernetes annotator cloning/refactoring for container sub-map; processing pipeline and timestamp benchmarks; timestamp parse-path refactor with centralized parseFailure; rename processor conditional event-clone-on-failure optimization; and smaller test updates and microbenchmarks.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

• 🛠️ Update Documentation: Commit on current branch
• 🛠️ Update Documentation: Create PR

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@libbeat/processors/actions/rename.go`:
- Around line 81-83: The rollback logic incorrectly only clones the event when
f.config.FailOnError && len(f.config.Fields) > 1, which leaves single-field
renames vulnerable to partial mutation if renameField fails; update the code so
that when f.config.FailOnError is true you always clone the event (create backup
= event.Clone()) before any mutation occurs (i.e., remove the
len(f.config.Fields) > 1 condition and perform the clone prior to calling
renameField/Delete/PutValue) so that the restore path can reliably restore the
original event on error.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b02f807e-ad6c-4605-8676-8d73aadb8307

📥 Commits

Reviewing files that changed from the base of the PR and between f173ddf and f7ea598.

📒 Files selected for processing (2)

• libbeat/processors/actions/rename.go
• libbeat/processors/actions/rename_benchmark_test.go

✅ Files skipped from review due to trivial changes (1)

• libbeat/processors/actions/rename_benchmark_test.go

[github-actions]

TL;DR

Buildkite failures are all the same root cause: processor error-message casing changed (Failed... → failed...), but tests still assert the old string values. Update either the processor error prefixes or the expected strings in tests so they match consistently.

Remediation

• Make error message casing consistent between implementation and tests for:
  • libbeat/processors/actions/decompress_gzip_field.go:77 vs libbeat/processors/actions/decompress_gzip_field_test.go:106,143
  • libbeat/processors/actions/rename.go:85 vs libbeat/processors/actions/rename_test.go:99,198
• Re-run:
  • cd libbeat && mage build unitTest
  • cd libbeat && mage goUnitTest
  • cd libbeat && mage goFIPSOnlyUnitTest
  • cd libbeat && mage goIntegTest

Investigation details

Root Cause

This is a test failure (not infra): assertions compare full error.message text and fail on capitalization differences.

From failed logs, actual events contain lowercase prefixes:

• failed to decompress field in decompress_gzip_field processor: ...
• failed to rename fields in processor: ...

But tests expect uppercase prefixes:

• Failed to decompress field in decompress_gzip_field processor: ...
• Failed to rename fields in processor: ...

This causes:

• TestDecompressGzip/... equality diffs (explicit expected vs actual message mismatch)
• TestRenameRun/... deep-equality failures at rename_test.go:253

Evidence

• Build: https://buildkite.com/elastic/beats/builds/43262
• Failed jobs (4):
  • Libbeat: Ubuntu x86_64 Unit Tests
  • Libbeat: Ubuntu x86_64 Go Unit Tests with fips provider and requirefips build tag
  • Libbeat: Ubuntu x86_64 fips140=only Unit Tests
  • Libbeat: Go Integration Tests
• Key log excerpts (all 4 jobs show same pattern):
  • expected: "Failed to decompress ..."
  • actual: "failed to decompress ..."
  • plus TestRenameRun/... failures with rename debug log showing lowercase failed to rename ...

Verification

• I ran locally on current checkout:
  • cd libbeat && go test ./processors/actions -run 'TestDecompressGzip|TestRenameRun' -count=1
  • Result: pass on current tree.
• This is consistent with a PR-branch-only message-string change not mirrored in tests (or vice versa).

Follow-up

Pick one convention and apply it in both implementation and tests. If the PR intentionally normalized messages to lowercase (Go error style), update expected strings in tests accordingly.

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• pr:perf: combined processor allocation optimizations (do not merge) #49723 (pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.