From 55edac538c6082a5a6b8e911197dd338e220254f Mon Sep 17 00:00:00 2001
From: Maurizio Branca <maurizio.branca@elastic.co>
Date: Wed, 30 Aug 2023 11:09:48 +0200
Subject: [PATCH] [Azure] [Billing] Add Azure resource tags from Usage Details
 API (#36428)

* Add resource tags from Usage Details API

Both legacy and modern data formats support resource tags.

* Store tags in the azure.resource.tags field

The Azure module already has an existing mapping for the
`azure.resource.tags` field.

* Add a unit test to check the tags field mapping

* Update changelog

---------

Co-authored-by: muthu-mps <101238137+muthu-mps@users.noreply.github.com>
---
 CHANGELOG.next.asciidoc                           |  1 +
 x-pack/metricbeat/module/azure/billing/data.go    |  8 ++++++++
 .../metricbeat/module/azure/billing/data_test.go  | 15 ++++++++++++++-
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index b0c2e143b9b..2f996756908 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -229,6 +229,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Migrate Azure Billing, Monitor, and Storage metricsets to the newer SDK. {pull}33585[33585]
 - Add support for float64 values parsing for statsd metrics of counter type. {pull}35099[35099]
 - Add kubernetes.deployment.status.* fields for Kubernetes module {pull}35999[35999]
+- Add Azure resource tags support to Azure Billing module {pull}36428[36428]
 
 
 *Osquerybeat*
diff --git a/x-pack/metricbeat/module/azure/billing/data.go b/x-pack/metricbeat/module/azure/billing/data.go
index 73d2da05dd2..bec33fcf185 100644
--- a/x-pack/metricbeat/module/azure/billing/data.go
+++ b/x-pack/metricbeat/module/azure/billing/data.go
@@ -60,6 +60,10 @@ func EventsMapping(
 						"group": legacy.Properties.ResourceGroup,
 					},
 				}
+				if len(legacy.Tags) > 0 {
+					_, _ = event.ModuleFields.Put("resource.tags", legacy.Tags)
+				}
+
 				event.MetricSetFields = mapstr.M{
 					// original fields
 					"billing_period_id": legacy.ID,
@@ -96,6 +100,10 @@ func EventsMapping(
 						"group": strings.ToLower(*modern.Properties.ResourceGroup),
 					},
 				}
+				if len(modern.Tags) > 0 {
+					_, _ = event.ModuleFields.Put("resource.tags", modern.Tags)
+				}
+
 				event.MetricSetFields = mapstr.M{
 					// original fields
 					"billing_period_id": modern.ID,
diff --git a/x-pack/metricbeat/module/azure/billing/data_test.go b/x-pack/metricbeat/module/azure/billing/data_test.go
index 49a16fcd617..bf800821f1c 100644
--- a/x-pack/metricbeat/module/azure/billing/data_test.go
+++ b/x-pack/metricbeat/module/azure/billing/data_test.go
@@ -25,6 +25,8 @@ func TestEventMapping(t *testing.T) {
 	name := "test"
 	billingAccountId := "123"
 	startDate := time.Time{}
+	tagName := "team"
+	tagValue := "obs-cloud-monitoring"
 
 	//
 	// Usage Details
@@ -49,6 +51,9 @@ func TestEventMapping(t *testing.T) {
 		ID:         &ID,
 		Kind:       &kind,
 		Properties: &props,
+		Tags: map[string]*string{
+			tagName: &tagValue,
+		},
 	}
 
 	//
@@ -102,15 +107,23 @@ func TestEventMapping(t *testing.T) {
 	// Check the results
 	//
 	for _, event := range events {
-		// if is an usage event
 		if ok, _ := event.MetricSetFields.HasKey("department_name"); ok {
+			//
+			// The event is a usage detail
+			//
 			val1, _ := event.MetricSetFields.GetValue("account_name")
 			assert.Equal(t, val1, &name)
 			val2, _ := event.MetricSetFields.GetValue("product")
 			assert.Equal(t, val2, &name)
 			val3, _ := event.MetricSetFields.GetValue("department_name")
 			assert.Equal(t, val3, &name)
+			tags, _ := event.ModuleFields.GetValue("resource.tags")
+			assert.Equal(t, tags, map[string]*string{tagName: &tagValue})
+
 		} else {
+			//
+			// The event is a forecast
+			//
 
 			// Check the actual cost
 			isActual, _ := event.MetricSetFields.HasKey("actual_cost")