metricbeat sets the same correlation fields as filebeat, so one dashboard spans logs and metrics

Both Beats already wrote to the same Elasticsearch, but a metric event carried container.name while a log
event carried service.name and vanguard.category, so nothing joined them and a dashboard could only show the
two side by side. Metricbeat now runs add_docker_metadata and the same copy_fields, giving both sides
@timestamp, host.name, container.name, service.name and vanguard.category.

LOGGING.md documents the join keys and the one Kibana step that makes it work: a single data view over
filebeat-*,metricbeat-* so one filter applies to metric panels and log panels together.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

observability/metricbeat.yml

@@ -29,6 +29,17 @@ metricbeat.modules:
 
 processors:
   - add_host_metadata: ~
+  # The same correlation fields Filebeat sets, so ONE dashboard filter spans logs and metrics. Without these a
+  # metric event carries container.name while a log event carries service.name, and nothing joins them.
+  - add_docker_metadata: ~
+  - copy_fields:
+      fields:
+        - from: container.labels.vanguard_service
+          to: service.name
+        - from: container.labels.vanguard_category
+          to: vanguard.category
+      fail_on_error: false
+      ignore_missing: true
 
 output.elasticsearch:
   hosts: ["http://127.0.0.1:9200"]