Add diag_documents_volume

[nicholasberlin]

Change Summary

Track diagnostic events volumes separately from production events.

Sample values

                "diag_documents_volume": {
                    "dns_events": {
                        "sent_bytes": 0,
                        "sent_count": 0,
                        "suppressed_bytes": 6331,
                        "suppressed_count": 4
                    },
                    "overall": {
                        "sent_bytes": 1819060,
                        "sent_count": 1101,
                        "suppressed_bytes": 9686398,
                        "suppressed_count": 5866
                    },
                    "process_events": {
                        "sent_bytes": 1819060,
                        "sent_count": 1101,
                        "sources": [
                            {
                                "sent_bytes": 1379792,
                                "sent_count": 827,
                                "source": "ptrace",
                                "suppressed_bytes": 7329613,
                                "suppressed_count": 4395
                            },
                            {
                                "sent_bytes": 439268,
                                "sent_count": 274,
                                "source": "termination",
                                "suppressed_bytes": 2350454,
                                "suppressed_count": 1467
                            }
                        ],
                        "suppressed_bytes": 9680067,
                        "suppressed_count": 5862
                    }
                },

Release Target

9.3

For mapping changes:

• I ran make after making the schema changes, and committed all changes

[pzl]

Can you put the sample values from the comment into the file at package/endpoint/data_stream/metrics/sample_event.json?

also the extra diff on the README was a bug from elsewhere. When #695 merges, you can pull in main and running make again should not produce that diff anymore.