Missing host.os.type field mapping

[ebeahan]

The endpoint is missing a field mapping for host.os.type.

This screenshot is from Elastic Agent 8.0.0 with endpoint enabled:

A potential cause is a field not explicitly defined in the subset files: https://github.com/elastic/endpoint-package/blob/master/custom_subsets/elastic_endpoint/network/network.yaml#L24.

[ebeahan]

CC @randomuserid, who initially spotted the missing mapping.

[pzl]

I'm not sure the Endpoint sends any data with host.os.type. Here is an example of what Endpoint sends to those indices:

  "host" : {
    "hostname" : "security-win-1",
    "os" : {
      "Ext" : {
        "variant" : "Windows Server 2019 Datacenter"
      },
      "kernel" : "1809 (10.0.17763.2686)",
      "name" : "Windows",
      "family" : "windows",
      "type" : "windows",
      "version" : "1809 (10.0.17763.2686)",
      "platform" : "windows",
      "full" : "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
    },
    "ip" : [
      "10.201.0.34",
      "fe80::4850:4f4f:4b53:8103",
      "127.0.0.1",
      "::1"
    ],
    "name" : "security-win-1",
    "id" : "bbea673e-eae6-4b03-8724-2183f79da331",
    "mac" : [
      "42:01:0a:c9:00:22"
    ],
    "architecture" : "x86_64"
  },

[ferullo]

host.os.type is in that example document.