[Elastic Agent] Agent.id of running processes

[ph]

Agent with System and Endpoint integrations. All agent.id's were different for the same host.

Agent: bffe5cf9-2436-476e-b4cb-39c64235b866
Filebeat: 40154036-66e3-4b71-9505-54c5e6ca74aa
Metricbeat: b9e0d066-a255-4e31-9dfe-13b1419da034
Endpoint: 49ecf6c5-6e09-4a36-8fc5-8f8dbaa77649

I think we should have the same ID on everything so we can correlate events generated by the "Elastic Agent"

[elasticmachine]

Pinging @elastic/ingest-management (Team:Ingest Management)

[ph]

@blakerouse @ruflin WDYT?

[ferullo]

cc @scunningham @kevinlog

For my part, I am ambivalent whether Agent, Beats, Endpoint all share the same ID or not. Endpoint reports elastic.agent.id in all documents, which is Agent's ID, so Endpoint documents can be correlated even if Endpoint and Agent don't share the same ID.

[blakerouse]

@ph surprised they are all different, I would expect them to all be the same.

[ruflin]

I assume all elastic.agent.ids are the same? It is just that the agent.id are different as they are generated by each process? I agree this might be confusing as the processes should be an implementation detail.

[ruflin]

Second thought: I wonder if we should even ship agent.id for the processes, as not in all cases the process itself is actually the agent but sometimes the observer.

[ph]

@ruflin @blakerouse So the fix would makes sure that all process send the elastic.agent.id with the same id, the one from the agent.

Concerning Agent.id, Is this coming from the actual input in metricbeat/filebeat?

[ruflin]

Yes, I would already expect today that elastic.agent.id is identical everywhere. Is this also not the case?

For agent.id, I think each input should decide to send it or not. But that will be more a Beats problem to solve. By default, it should not be sent.

[kevinlog]

For my part, I am ambivalent whether Agent, Beats, Endpoint all share the same ID or not. Endpoint reports elastic.agent.id in all documents, which is Agent's ID, so Endpoint documents can be correlated even if Endpoint and Agent don't share the same ID.

What's important to me is that we still have the elastic.agent.id in the Endpoint so that we can use it in the app. It elastic.agent.id and agent.id end up being the same, that's fine too.

cc @ferullo @ph @ruflin

[ph]

@blakerouse I believe that metrics/logs collected by the Elastic-Agent doesn't include that the agent id?