search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
12.05k stars 4.89k forks source link

Regression: `host.hostname` is being lowercased #39993

Open ycombinator opened 1 week ago

ycombinator commented 1 week ago

Version

8.15.0-SNAPSHOT, 8.13.2, likely any version >= 8.9.0.

Operating System

Windows 10, but quite likely this is happening on any Windows versions, and likely on any OS that allows setting a hostname with uppercase characters in it.

Steps to Reproduce

  1. Ensure that the host on which Agent is going to run has a hostname with uppercase characters in it, e.g. DESKTOP-E39GQOG.
  2. Enroll Elastic Agent in Fleet, using the default policy with the system integration enabled.
  3. About 30 seconds after enrolling, go to Kibana > Discover and look at the logs-* indices for data from the Agent. Set up the columns as shown in the screenshot below. 8 15 0-SNAPSHOT
  4. Note the values in the host.hostname column.

Expected behavior

The values of the host.hostname field should be exactly the same as of the hostname from step 1 above, including matching the case exactly.

Observed behavior

The values of the host.hostname field are lowercased.

Other relevant information

This behavior is not observed in 8.8.2: 8 8 2

⚠️ When fixing this regression, only the value of the host.hostname field should be fixed. The value of host.name should remain lowercased, as mandated by ECS. Similarly, the value of agent.name should not be impacted by the fix either.

elasticmachine commented 1 week ago

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

efd6 commented 4 days ago

It looks to me like this happens because of elastic/go-sysinfo#180. This was picked up in e35a094c0cf432732391a536d079f2b763771dfc which is in the 8.9 branch.