Prefer set with copy_from

[joegallo]

Proposed commit message

Prefer the copy_from option of the set processor for certain high volume integrations.

When the field to be copied is already just a string, and so the set processor with mustache isn't being used for the side effect of converting to a string, then it's quite a bit faster to use copy_from rather than value (with mustache templating).

For example, in a large cluster that I was looking at a few minutes ago, the most expensive single set processor is this one:

{
  "set": {
    "field": "cloud.account.id",
    "if": "ctx.aws?.vpcflow?.account_id != null",
    "value": "{{aws.vpcflow.account_id}}"
  }
}

It's taking 2.8 microseconds per doc, as compared to the average of all set processor invocations for the same pipeline which is only .6 microseconds per doc. The cluster in question is processing billions and billions of documents per hour, though, so microseconds add up (and this particularly-expensive set processor is the eighth-most expensive processor for the entire pipeline).

Originally this PR also had some copy_from changes for the panw integration, but I've moved those changes into #15800.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package gcp 👍(3) 💚(2) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
vpcflow	4545.45	3048.78	-1496.67 (-32.93%)	💔

To see the full report comment with /test benchmark fullreport

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[joegallo]

/test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 03c3166

History

• 💚 Build #33463 succeeded 284f42d
• 💚 Build #33368 succeeded 284f42d
• 💚 Build #32647 succeeded d8b599b
• 💚 Build #31141 succeeded 66b23a7
• 💚 Build #31135 succeeded a79b6aa
• 💔 Build #31127 failed a79b6aa

[efd6]

Thanks

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)