perf: remove unnecessary allocations in hot-path processors

[strawgate]

Summary

Remove unnecessary allocations in four hot-path processors. Each change is a targeted removal of wasteful Clone() calls or deferred allocation — no new APIs, no behavioral changes.

Changes

• add_docker_metadata: Remove redundant Clone() of a locally-built map that is never reused. Also updates deprecated cgroup.NewReader → cgroup.NewReaderOptions.
• add_kubernetes_metadata: Reduce from 3 full metadata Clone() calls to 1 full clone + 1 container sub-clone. The removed clone was metaClone.Clone().GetValue() where GetValue is read-only.
• timestamp: Defer parseError allocation to the failure path. Previously allocated on every call regardless of outcome.
• publisher/processing: Remove dead event.Meta.Clone() whose return value was never captured.

Per-processor benchmarks

Processor	Δ ns/op	Δ B/op	Δ allocs/op
add_docker_metadata	-30%	-35%	-26%
add_kubernetes_metadata	-52%	-55%	-55%
timestamp (single layout)	-11%	-14%	-17%

Test plan

• All existing tests pass
• New benchmarks for docker metadata, kubernetes metadata, and timestamp processors
• New correctness tests for kubernetes annotator covering container field split, missing fields, cache immutability, and event independence

🤖 Generated with Claude Code

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @strawgate? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c4eb8ba9-6e8b-4fd0-8355-24438f38de3c

📥 Commits

Reviewing files that changed from the base of the PR and between cd1b5d2 and d721bd4.

📒 Files selected for processing (10)

• changelog/fragments/1774755443-remove-unnecessary-allocations.yaml
• libbeat/beat/event_test.go
• libbeat/processors/add_docker_metadata/add_docker_metadata.go
• libbeat/processors/add_docker_metadata/add_docker_metadata_benchmark_test.go
• libbeat/processors/add_kubernetes_metadata/annotator_run_test.go
• libbeat/processors/add_kubernetes_metadata/benchmark_test.go
• libbeat/processors/add_kubernetes_metadata/kubernetes.go
• libbeat/processors/timestamp/timestamp.go
• libbeat/processors/timestamp/timestamp_benchmark_test.go
• libbeat/publisher/processing/processors.go

💤 Files with no reviewable changes (1)

• libbeat/publisher/processing/processors.go

✅ Files skipped from review due to trivial changes (5)

• changelog/fragments/1774755443-remove-unnecessary-allocations.yaml
• libbeat/processors/add_docker_metadata/add_docker_metadata.go
• libbeat/processors/add_kubernetes_metadata/benchmark_test.go
• libbeat/processors/timestamp/timestamp_benchmark_test.go
• libbeat/processors/add_kubernetes_metadata/annotator_run_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• libbeat/beat/event_test.go
• libbeat/processors/add_docker_metadata/add_docker_metadata_benchmark_test.go

---

📝 Walkthrough

Walkthrough

This PR reduces unnecessary allocations in several hot-path processors and adds benchmarks. Changes: test assertion in event test switched to exact string equality; Docker metadata now merges metadata without cloning; Kubernetes metadata clones only the container sub-map when building OCI container fields; timestamp parsing defers allocation of detailed errors and centralizes failure logging; publisher meta merging omits an unused clone. Added benchmarks for Docker metadata, Kubernetes annotator, and timestamp. A changelog fragment records the enhancement.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

• 🛠️ Update Documentation: Commit on current branch
• 🛠️ Update Documentation: Create PR

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)