Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

patterns ecs-v1 to use host.name instead of host.hostname #326

Open
jguay opened this issue Jun 26, 2024 · 0 comments
Open

patterns ecs-v1 to use host.name instead of host.hostname #326

jguay opened this issue Jun 26, 2024 · 0 comments

Comments

@jguay
Copy link

jguay commented Jun 26, 2024

At the moment the default patterns coming from ecs-v1 use host.hostname (same is defined for elasticsearch ingest node)

ECS documentation for host list both host.name and host.hostname

However most integrations currently use host.name so Kibana visualizations/dashboard tend to use this field causing them not to be usable when host.hostname is used


Workaround solutions :

  • add a second field host.name on logstash pipeline (or elasticsearch ingest node pipeline) at ingestion time to have both fields and be able to use common visualizations
  • add a runtime field to add host.name to the indices (and index templates)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant