search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.81k stars 8.2k forks source link

[Infra] Hosts view show up duplicate hosts #178650

Closed cauemarcondes closed 6 months ago

cauemarcondes commented 7 months ago

I'm running on my local environment the APM agent and Metricbeats, and when I open the hosts view I see my local host twice.

Screenshot 2024-03-13 at 16 01 38

This becomes more problematic as I cannot correlate APM services running on that host.

Screenshot 2024-03-13 at 15 41 04
elasticmachine commented 7 months ago

Pinging @elastic/obs-ux-infra_services-team (Team:obs-ux-infra_services)

roshan-elastic commented 7 months ago

Thanks for this @cauemarcondes. I'm trying to get a sense of scale/impact here...do we know when this happens?

e.g. does this happen every time a host name is not all lower-case? (e.g. an EC2 instance which isn't entered as lower-case)

@smith do you think this is something we should try and address or should we be asking the APM agent team / normal agent teams to be consistent?

crespocarlos commented 6 months ago

The query would have to run a terms aggs that is case insensitive if we want to remove duplicates at query level. Probably the best solution would be if APM agents and metricbeat shipped the same host.name.

smith commented 6 months ago

I've opened https://github.com/elastic/beats/issues/38689 and am closing this. The host name is case sensitive and should not be modified by agents.

trentm commented 6 months ago

@cauemarcondes Do you know which APM agent(s) and Beat(s) were reporting those host.name values? E.g. can you show agent.* values for the Elasticsearch documents with those two variants of the host.name value?

cauemarcondes commented 6 months ago

Do you know which APM agent(s) and Beat(s) were reporting those host.name values?

I used the APM GO (github.com/gin-gonic/gin v1.9.1) agent and metricbeat-8.12.1-darwin-x86_64

roshan-elastic commented 6 months ago

@smith - should we reopen this and add it to the backlog in either HCS phase I or phase II?

Wondering which phase it makes sense to be done in?

As a user, I'd want it to be part of phase I given other deliverables in the acceptance criteria but I don't know if that's realistic.

smith commented 6 months ago

@roshan-elastic the UI problem is a side-effect of the data problem which is being solved between beats, APM, and Otel agents. A UI fix would be counter-productive and we should leave this closed.

Additionally, we haven't seen any reports from customers having this problem in production environments.