`host.name` is empty we need to use `host.hostname`

[salvatore-campagna]

If the host.name field does not exists, indices created as backing indices of a data stream are injected with empty values of host.name. Sorting on host.name and @timestamp results in sorting just on @timestamp. Looking at some mappings I see a host.hostname exists. Also a cardinality aggregation results in hundreds of distinct values which suggests the filed is not empty.

We would like to test using a meaningful combination of fields to sort on. Ideally we expect better benchmark results despite being possible that other, more effective, combinations of fields might exist. We are interested, anyway, in changes over time given a valid set of fields to sort on.

This needs backporting to 8.15

[salvatore-campagna]

@gbanasiak we don't need to delete old races data...it might actually be useful to see the difference in this case.

[gbanasiak]

Review notes:

• host.hostname field seems to be present in all endpoint documents (checked file and process),
• the cardinality of this field is 100,
• value format: <english-first-name>.[linux|windows].

[salvatore-campagna]

💚 All backports created successfully

Status	Branch	Result
✅	8.15

Questions ?

Please refer to the Backport tool documentation