beats icon indicating copy to clipboard operation
beats copied to clipboard

Regression: `host.hostname` is being lowercased

Open ycombinator opened this issue 1 year ago • 2 comments

Version

8.15.0-SNAPSHOT, 8.13.2, likely any version >= 8.9.0.

Operating System

Windows 10, but quite likely this is happening on any Windows versions, and likely on any OS that allows setting a hostname with uppercase characters in it.

Steps to Reproduce

  1. Ensure that the host on which Agent is going to run has a hostname with uppercase characters in it, e.g. DESKTOP-E39GQOG.
  2. Enroll Elastic Agent in Fleet, using the default policy with the system integration enabled.
  3. About 30 seconds after enrolling, go to Kibana > Discover and look at the logs-* indices for data from the Agent. Set up the columns as shown in the screenshot below. 8 15 0-SNAPSHOT
  4. Note the values in the host.hostname column.

Expected behavior

The values of the host.hostname field should be exactly the same as of the hostname from step 1 above, including matching the case exactly.

Observed behavior

The values of the host.hostname field are lowercased.

Other relevant information

This behavior is not observed in 8.8.2: 8 8 2

⚠️ When fixing this regression, only the value of the host.hostname field should be fixed. The value of host.name should remain lowercased, as mandated by ECS. Similarly, the value of agent.name should not be impacted by the fix either.

ycombinator avatar Jun 22 '24 00:06 ycombinator

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

elasticmachine avatar Jun 22 '24 00:06 elasticmachine

It looks to me like this happens because of elastic/go-sysinfo#180. This was picked up in e35a094c0cf432732391a536d079f2b763771dfc which is in the 8.9 branch.

efd6 avatar Jun 25 '24 03:06 efd6