search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
12.2k stars 4.93k forks source link

[All beats] HTTP request should include the beat name and the version as part of the user-agent #18160

Closed archon810 closed 3 years ago

archon810 commented 4 years ago

This is a follow-up to https://github.com/elastic/beats/issues/10170, but for all beats, not just Heartbeat.

Specifically, Metricbeat in my case (I haven't checked the others).

elasticmachine commented 4 years ago

Pinging @elastic/integrations-services (Team:Services)

ph commented 4 years ago

For the person doing the implementation, its matter of auditing all the HTTP we are using in the beats and add a round tripper to the http client. You could reuse the code in

https://github.com/elastic/beats/blob/cfffc582482d1ad0a5b91c17a4176ce0a1f74c41/x-pack/elastic-agent/pkg/kibana/round_trippers.go#L20-L33

botelastic[bot] commented 3 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

archon810 commented 3 years ago

Bump.

wasserman commented 3 years ago

It helpful to include the beat's hostname and/or IP in this User-Agent string. I am thinking of scenarios where there is a beat failing to authenticate to the cluster and it is hitting the cloud through a corporate proxy. All beats may appear to come from the same IP, which makes identifying the problem beat challenging. Adding hostname/IP could make it easier for the team that focusing on the Elastic stack in an organization to identify the source host. This would allow auth or apikey failures to have an audit trail when a load-balancer is logging the User-Agent string. Maybe even available in Elastic logs if this is support and can be switched on log4j.

elasticmachine commented 3 years ago

Pinging @elastic/agent (Team:Agent)