-
Notifications
You must be signed in to change notification settings - Fork 5k
Set agent.name to hostname by default #18000
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Set agent.name to hostname by default #18000
Conversation
e0905d7 to
612a17a
Compare
c00f9fb to
c0e59e7
Compare
|
Pinging @elastic/siem (Team:SIEM) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
should "name" also be here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nevermind, I see this has not changed
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Correct, I didn't change observer. I had to separate them to avoid introducing changes to it. observer does need some changes, but that's another task - probably for 8.0.
💚 Build SucceededExpand to view the summary
Build stats
Test stats 🧪
Steps errorsExpand to view the steps failures
|
Since ECS does not define agent.hostname it will be removed in a future release. In order to always have a field available to identify the agent by name we will set the agent.name to hostname unless the user has provided a custom name. Relates elastic#16377
3d845bb to
db5eb1c
Compare
|
run tests |
Since ECS does not define agent.hostname it will be removed in a future release. In order to always have a field available to identify the agent by name we will set the agent.name to hostname unless the user has provided a custom name. Relates elastic#16377 (cherry picked from commit 3711ee6)
What does this PR do?
Since ECS does not define
agent.hostnameit will be removed in a future release.In order to always have a field available to identify the agent by name we will
set the agent.name to hostname unless the user has provided a custom name.
Why is it important?
This puts the hostname into events by default. This will be important for cases where events may not contain the forwarding machine's hostname. For example when forwarding syslog data we may not have the
hostorobservernamespaces populated.Checklist
- [ ] I have made corresponding change to the default configuration filesCHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Related issues
Relates #16377
Logs
Event output when
nameis unset.Event when
name: my_custom_nameis set: