-
Couldn't load subscription status.
- Fork 976
Open
Labels
Description
At the moment the default patterns coming from ecs-v1 use host.hostname (same is defined for elasticsearch ingest node)
ECS documentation for host list both host.name and host.hostname
However most integrations currently use host.name so Kibana visualizations/dashboard tend to use this field causing them not to be usable when host.hostname is used
Workaround solutions :
- add a second field
host.nameon logstash pipeline (or elasticsearch ingest node pipeline) at ingestion time to have both fields and be able to use common visualizations - add a runtime field to add
host.nameto the indices (and index templates)