Beat name is always overridden by hostname

[ycombinator]

For confirmed bugs, please report:

• Version: 8.0.0 / master but also seen in 7.6.2.
• Operating System: Mac OS X
• Steps to Reproduce:

1. Create a minimal Filebeat configuration as follows.

   ## filebeat.test.yml
   name: fb1
   
   filebeat.inputs:
     - type: stdin
       enabled: true
   
   output.console:
     enabled: true
   
   http.enabled: true
   

2. Start up an instance of Filebeat with above configuration.

   ./filebeat -c filebeat.test.yml
   

3. Visit http://localhost:5066/. Notice that the name field is set to the hostname, instead of the value of the name setting from the Filebeat configuration.

   curl -s 'http://localhost:5066/' | jq
   {
     "beat": "filebeat",
     "hostname": "Shaunaks-MacBook-Pro-Work.local",
     "name": "Shaunaks-MacBook-Pro-Work.local",
     "uuid": "ef61dc4a-8be0-404a-8e8a-d1a8d8bb17d8",
     "version": "7.6.0"
   }
   

• Impact:
  One of the places where this information is used is in the Stack Monitoring UI. So if you have two Beats running on the same host but with different name settings, they incorrectly show up with the same name (the hostname instead of their respective names) in the UI:

  

[elasticmachine]

Pinging @elastic/stack-monitoring (Stack monitoring)

[sayden]

Related issues:

• Beats use of non-ECS field agent.hostname causing user confusion Beats use of non-ECS field agent.hostname causing user confusion #16377
• [Filebeat 7.5.0 module cisco] host.name should not be the "Filebeat Agent Name" [Filebeat 7.5.0 module cisco] host.name should not be the "Filebeat Agent Name" #14933
• Setting host.* in Beats that forward data Setting host.* in Beats that forward data #13920. Includes:
  • host.name behavior inconsistent across the Elastic stack host.name behavior inconsistent across the Elastic stack #13777
  • [winlogbeat] Use the original host for host.name in Windows Event Logs [winlogbeat] Use the original host for host.name in Windows Event Logs #13706
  • [Filebeat] The host.name sent from Filebeat doesn't match the same field from Metricbeat [Filebeat] The host.name sent from Filebeat doesn't match the same field from Metricbeat #13589
  • Not always send host.name and have host metadata processor enabled Not always send host.name and have host metadata processor enabled #10698
• host.name behavior inconsistent across the Elastic stack host.name behavior inconsistent across the Elastic stack #13777. Includes:
  • [winlogbeat] Use the original host for host.name in Windows Event Logs [winlogbeat] Use the original host for host.name in Windows Event Logs #13706
  • [Filebeat] The host.name sent from Filebeat doesn't match the same field from Metricbeat [Filebeat] The host.name sent from Filebeat doesn't match the same field from Metricbeat #13589
  • Module dashboards should not use non-ECS agent.hostname fields Module dashboards should not use non-ECS agent.hostname fields #12983
  • [Heartbeat] host.name should not be set in heartbeat [Heartbeat] host.name should not be set in heartbeat #12107
  • Not always send host.name and have host metadata processor enabled Not always send host.name and have host metadata processor enabled #10698
• [Filebeat] The host.name sent from Filebeat doesn't match the same field from Metricbeat [Filebeat] The host.name sent from Filebeat doesn't match the same field from Metricbeat #13589
• Module dashboards should not use non-ECS agent.hostname fields Module dashboards should not use non-ECS agent.hostname fields #12983. Includes:
  • Auditbeat visualisation do not use ECS #11860
  • Missing field changes in the 7.0 breaking changes doc #11790

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[ChrsMark]

Reopening this since it seems it was closed by the bot and we still have cases hitting this.

cc: @sayden @masci @exekias

[ethnchao]

It has been a year ago, still not solved.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!