Add linked account information into billing metricset (#26285) (#26451)

(cherry picked from commit d512dc0)

CHANGELOG.next.asciidoc

@@ -663,6 +663,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Reduce number of requests done by kubernetes metricsets to kubelet. {pull}25782[25782]
 - Migrate rds metricsets to use cloudwatch input. {pull}26077[26077]
 - Migrate sqs metricsets to use cloudwatch input. {pull}26117[26117]
+- Collect linked account information in AWS billing. {pull}26285[26285]
 - Add total CPU to vSphere virtual machine metrics. {pull}26167[26167]
 
 *Packetbeat*

metricbeat/docs/fields.asciidoc

@@ -1563,6 +1563,27 @@ type: object
 
 --
 
+
+*`aws.linked_account.id`*::
++
+--
+ID used to identify linked account.
+
+
+type: keyword
+
+--
+
+*`aws.linked_account.name`*::
++
+--
+Name or alias used to identify linked account.
+
+
+type: keyword
+
+--
+
 [float]
 === billing
 

x-pack/metricbeat/module/aws/_meta/config.yml

@@ -38,8 +38,9 @@
       - "AZ"
       - "INSTANCE_TYPE"
       - "SERVICE"
-#    group_by_tag_keys:
-#      - "aws:createdBy"
+      - "LINKED_ACCOUNT"
+    group_by_tag_keys:
+      - "aws:createdBy"
 - module: aws
   period: 24h
   metricsets:

x-pack/metricbeat/module/aws/_meta/fields.yml

@@ -30,3 +30,14 @@
           object_type_mapping_type: "*"
           description: >
             Metrics that returned from Cloudwatch API query.
+        - name: linked_account
+          type: group
+          fields:
+            - name: id
+              type: keyword
+              description: >
+                ID used to identify linked account.
+            - name: name
+              type: keyword
+              description: >
+                Name or alias used to identify linked account.