elasticsearch
elasticsearch copied to clipboard
patterns ecs-v1 to use host.name instead of host.hostname
Description
Feature request also raised in https://github.com/logstash-plugins/logstash-patterns-core/issues/326
At the moment the default patterns coming from ecs-v1 use host.hostname (same is defined for logstash ingest node)
ECS documentation for host list both host.name and host.hostname
However most integrations currently use host.name so Kibana visualizations/dashboard tend to use this field causing them not to be usable when host.hostname is used
Such change is potentially a breaking changes for user who rely on host.hostname naming which also need to be addressed
Workaround solutions :
- add a second field
host.nameon elasticsearch ingest node pipeline at ingestion time to have both fields and be able to use common visualizations - add a runtime field to add
host.nameto the indices (and index templates)
Pinging @elastic/es-data-management (Team:Data Management)