[microsoft_dhcp] Fix incorrect log parsing for DHCP host.domain -> host.name

packages/microsoft_dhcp/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.7.0"
+  changes:
+    - description: Change host.domain to host.name to reflect the event data and then extract host.domain from the host.name
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/4280
 - version: "1.6.0"
   changes:
     - description: Update package to ECS 8.4.0

packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-log.log-expected.json

@@ -78,7 +78,8 @@
                 ]
             },
             "host": {
-                "domain": "057182593757.test.com",
+                "domain" : "test.com",
+                "name": "057182593757.test.com",
                 "ip": "172.28.43.169"
             },
             "log": {
@@ -118,7 +119,8 @@
                 ]
             },
             "host": {
-                "domain": "1-07.test.com",
+                "domain" : "test.com",
+                "name": "1-07.test.com",
                 "ip": "172.28.53.173"
             },
             "log": {
@@ -158,7 +160,8 @@
                 ]
             },
             "host": {
-                "domain": "3-07.test.com",
+                "domain" : "test.com",
+                "name": "3-07.test.com",
                 "ip": "172.28.53.36"
             },
             "log": {
@@ -240,7 +243,8 @@
                 ]
             },
             "host": {
-                "domain": "035856103966.test.com",
+                "domain" : "test.com",
+                "name": "035856103966.test.com",
                 "ip": "172.28.43.159"
             },
             "log": {
@@ -280,7 +284,8 @@
                 ]
             },
             "host": {
-                "domain": "001100581357.test.com",
+                "domain" : "test.com",
+                "name": "001100581357.test.com",
                 "ip": "172.28.40.35"
             },
             "log": {
@@ -321,7 +326,8 @@
                 ]
             },
             "host": {
-                "domain": "host.test.com",
+                "domain" : "test.com",
+                "name": "host.test.com",
                 "ip": "192.168.2.1",
                 "mac": [
                     "00-00-00-00-00-00"
@@ -358,7 +364,8 @@
                 ]
             },
             "host": {
-                "domain": "host.test.com",
+                "domain" : "test.com",
+                "name": "host.test.com",
                 "ip": "192.168.2.10",
                 "mac": [
                     "00-00-00-00-00-00"
@@ -401,7 +408,8 @@
                 ]
             },
             "host": {
-                "domain": "host.test.com",
+                "domain" : "test.com",
+                "name": "host.test.com",
                 "ip": "192.168.2.20",
                 "mac": [
                     "00-00-00-00-00-00"
@@ -484,7 +492,8 @@
                 ]
             },
             "host": {
-                "domain": "hostname.test.com",
+                "domain" : "test.com",
+                "name": "hostname.test.com",
                 "ip": "10.10.10.10"
             },
             "log": {
@@ -564,7 +573,8 @@
                 ]
             },
             "host": {
-                "domain": "domain.local"
+                "domain" : "local",
+                "name": "domain.local"
             },
             "log": {
                 "file": {
@@ -597,7 +607,8 @@
                 ]
             },
             "host": {
-                "domain": "domain.local"
+                "domain" : "local",
+                "name": "domain.local"
             },
             "log": {
                 "file": {
@@ -640,4 +651,4 @@
             ]
         }
     ]
-}
+}

packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-logv6.log-expected.json

@@ -122,7 +122,8 @@
                 "timezone": "America/New_York"
             },
             "host": {
-                "domain": "test.local"
+                "domain" : "local",
+                "name": "test.local"
             },
             "log": {
                 "file": {
@@ -155,7 +156,7 @@
                 ]
             },
             "host": {
-                "domain": "test-host",
+                "name": "test-host",
                 "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6"
             },
             "log": {
@@ -197,7 +198,7 @@
                 ]
             },
             "host": {
-                "domain": "test-host",
+                "name": "test-host",
                 "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6"
             },
             "log": {
@@ -239,7 +240,7 @@
                 ]
             },
             "host": {
-                "domain": "test-host",
+                "name": "test-host",
                 "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6"
             },
             "log": {
@@ -281,7 +282,7 @@
                 ]
             },
             "host": {
-                "domain": "test-host",
+                "name": "test-host",
                 "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6"
             },
             "log": {
@@ -323,7 +324,7 @@
                 ]
             },
             "host": {
-                "domain": "test-host",
+                "name": "test-host",
                 "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6"
             },
             "log": {
@@ -365,7 +366,7 @@
                 ]
             },
             "host": {
-                "domain": "test-host",
+                "name": "test-host",
                 "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6"
             },
             "log": {
@@ -407,7 +408,7 @@
                 ]
             },
             "host": {
-                "domain": "test-host",
+                "name": "test-host",
                 "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6"
             },
             "log": {
@@ -449,7 +450,7 @@
                 ]
             },
             "host": {
-                "domain": "test-host",
+                "name": "test-host",
                 "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6"
             },
             "log": {
@@ -500,4 +501,4 @@
             ]
         }
     ]
-}
+}

packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcp.yml

@@ -10,7 +10,7 @@ processors:
         - _tmp_.time
         - message
         - host.ip
-        - host.domain
+        - host.name
         - _tmp_.mac
         - user.name
         - microsoft.dhcp.transaction_id
@@ -25,6 +25,14 @@ processors:
         - microsoft.dhcp.relay_agent_info
         - microsoft.dhcp.dns_error_code
       ignore_failure: true
+  - grok:
+      field: host.name
+      if: 'ctx.host?.name != null && ctx.host.name.contains(".")'
+      patterns:
+        - "%{HOSTNAME}\\.%{GREEDYDATA:host.domain}"
+      pattern_definitions:
+        "HOSTNAME": "[^.]+"
+      ignore_failure: true
   - set:
       field: _tmp_.timestamp
       value: "{{{_tmp_.date}}} {{{_tmp_.time}}}"

packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcpv6.yml

@@ -9,14 +9,22 @@ processors:
         - _tmp_.time
         - message
         - host.ip
-        - host.domain
+        - host.name
         - microsoft.dhcp.error_code
         - microsoft.dhcp.duid.length
         - microsoft.dhcp.duid.hex
         - microsoft.dhcp.user.string
         - microsoft.dhcp.dhc_id
         - microsoft.dhcp.subnet_prefix
       ignore_failure: true
+  - grok:
+      field: host.name
+      if: 'ctx.host?.name != null && ctx.host.name.contains(".")'
+      patterns:
+        - "%{HOSTNAME}\\.%{GREEDYDATA:host.domain}"
+      pattern_definitions:
+        "HOSTNAME": "[^.]+"
+      ignore_failure: true
   - set:
       field: _tmp_.timestamp
       value: "{{{_tmp_.date}}} {{{_tmp_.time}}}"

packages/microsoft_dhcp/data_stream/log/fields/ecs.yml

@@ -20,6 +20,8 @@
   name: event.type
 - external: ecs
   name: host.domain
+- external: ecs
+  name: host.name
 - external: ecs
   name: host.ip
 - external: ecs

packages/microsoft_dhcp/docs/README.md

@@ -75,7 +75,7 @@ An example event for `log` looks as following:
     },
     "host": {
         "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6",
-        "domain": "test-host"
+        "name": "test-host"
     },
     "event": {
         "agent_id_status": "verified",
@@ -119,6 +119,7 @@ An example event for `log` looks as following:
 | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword |
 | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword |
 | host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword |
+| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword |
 | host.ip | Host ip addresses. | ip |
 | host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |
 | input.type |  | keyword |

packages/microsoft_dhcp/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: microsoft_dhcp
 title: Microsoft DHCP
-version: "1.6.0"
+version: "1.7.0"
 license: basic
 description: Collect logs from Microsoft DHCP with Elastic Agent.
 type: integration