Fix volume attachment event parsing and KeyError on volume create/delete

The correct name of the server-identifying field in volume attach/detach
notification is `instance_uud`, not `server_id`, see
`cinder/objects/volume_attachment.py`

Cinder changed format of notifications in rocky,
as image_id in glance_metadata is not a list anymore

Related-Issue: PROD-35592
Change-Id: Idbeacd134afd01484f8098513a16e625de35b014
diff --git a/ceilometer/files/queens/event_definitions.yaml b/ceilometer/files/queens/event_definitions.yaml
index 83b4650..0814e2a 100644
--- a/ceilometer/files/queens/event_definitions.yaml
+++ b/ceilometer/files/queens/event_definitions.yaml
@@ -83,9 +83,9 @@
     created_at:
       fields: payload.created_at
     image_id:
-      fields: payload.glance_metadata[?key=image_id][0].value
+      fields: payload.glance_metadata[?key=image_id].value
     instance_id:
-      fields: payload.volume_attachment[0].server_id
+      fields: payload.volume_attachment[0].instance_uuid
 - event_type: ['volume.exists', 'volume.retype', 'volume.create.*', 'volume.delete.*', 'volume.resize.*', 'volume.attach.*', 'volume.detach.*', 'volume.update.*']
   traits:
     <<: *cinder_traits