Skip to content

patterns ecs-v1 to use host.name instead of host.hostname #326

@jguay

Description

@jguay

At the moment the default patterns coming from ecs-v1 use host.hostname (same is defined for elasticsearch ingest node)

ECS documentation for host list both host.name and host.hostname

However most integrations currently use host.name so Kibana visualizations/dashboard tend to use this field causing them not to be usable when host.hostname is used


Workaround solutions :

  • add a second field host.name on logstash pipeline (or elasticsearch ingest node pipeline) at ingestion time to have both fields and be able to use common visualizations
  • add a runtime field to add host.name to the indices (and index templates)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions