Support agent.features.include_tags_in_events - attach agent tags to collected events

[nchaulet]

Summary

Part of the "Agent tags propagation" design (related issue: elastic/kibana#271551). Fleet agent tags are not currently forwarded into the events (logs, metrics, traces) collected by the agent, making them unusable for filtering/dashboarding. This issue tracks the agent-side change needed to close that gap.

Proposed change

• Support the new policy field agent.features.include_tags_in_events (boolean, injected by Fleet Server, see fleet-server issue).
• When enabled, add a global processor that sets tags on outgoing events using the value from agent.tags (also injected by Fleet Server).
• agent.features.include_tags_in_events and agent.tags should also be passed through to Endpoint so it can apply the same tagging to its own data.

Related

• Related issue: [Fleet] Agent tags should be propagated to event data collected by Fleet-managed agents kibana#271551
• Kibana issue: Add agent.features.include_tags_in_events agent policy advanced setting kibana#276433
• Fleet Server issue: Inject agent tags into per-agent policy under agent.tags fleet-server#7321

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent (Team:Elastic-Agent)