Adding service.node.name (elastic#565)

.gitignore

@@ -5,3 +5,4 @@ env
 
 build
 .idea
+*.iml

CHANGELOG.next.md

@@ -12,6 +12,7 @@ Thanks, you're awesome :-) -->
 ### Added
 * Added `error.stack_trace` field. #562
 * Added `log.origin.file.name`, `log.origin.function` and `log.origin.file.line` fields. #563
+* Added `service.node.name` to allow distinction between different nodes of the same service running on the same host. #565
 * Added `error.type` field. #566
 
 ### Improvements

docs/field-details.asciidoc

@@ -3024,11 +3024,9 @@ example: `d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6`
 | service.name
 | Name of the service data is collected from.
 
-The name of the service is normally user given. This allows if two instances of the same service are running on the same machine they can be differentiated by the `service.name`.
+The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.
 
-Also it allows for distributed services that run on multiple hosts to correlate the related instances based on the name.
-
-In the case of Elasticsearch the service.name could contain the cluster name. For Beats the service.name is by default a copy of the `service.type` field if no name is specified.
+In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.
 
 type: keyword
 
@@ -3038,6 +3036,21 @@ example: `elasticsearch-metrics`
 
 // ===============================================================
 
+| service.node.name
+| Name of a service node.
+
+This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.
+
+In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.
+
+type: keyword
+
+example: `instance-0000000016`
+
+| extended
+
+// ===============================================================
+
 | service.state
 | Current state of the service.
 

generated/beats/fields.ecs.yml

@@ -2288,17 +2288,31 @@
       ignore_above: 1024
       description: 'Name of the service data is collected from.
 
-        The name of the service is normally user given. This allows if two instances
-        of the same service are running on the same machine they can be differentiated
-        by the `service.name`.
+        The name of the service is normally user given. This allows for distributed
+        services that run on multiple hosts to correlate the related instances based
+        on the name.
 
-        Also it allows for distributed services that run on multiple hosts to correlate
-        the related instances based on the name.
-
-        In the case of Elasticsearch the service.name could contain the cluster name.
-        For Beats the service.name is by default a copy of the `service.type` field
-        if no name is specified.'
+        In the case of Elasticsearch the `service.name` could contain the cluster
+        name. For Beats the `service.name` is by default a copy of the `service.type`
+        field if no name is specified.'
       example: elasticsearch-metrics
+    - name: node.name
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: 'Name of a service node.
+
+        This allows for two nodes of the same service running on the same host to
+        be differentiated. Therefore, `service.node.name` should typically be unique
+        across nodes of a given service.
+
+        In the case of Elasticsearch, the `service.node.name` could contain the unique
+        node name within the Elasticsearch cluster. In cases where the service doesn''t
+        have the concept of a node name, the host name or container name can be used
+        to distinguish running instances that make up this service. If those do not
+        provide uniqueness (e.g. multiple instances of the service running on the
+        same host) - the node name can be manually set.'
+      example: instance-0000000016
     - name: state
       level: core
       type: keyword

generated/csv/fields.csv

@@ -292,6 +292,7 @@ server.user.name,keyword,core,albert,1.2.0-dev
 service.ephemeral_id,keyword,extended,8a4f500f,1.2.0-dev
 service.id,keyword,core,d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6,1.2.0-dev
 service.name,keyword,core,elasticsearch-metrics,1.2.0-dev
+service.node.name,keyword,extended,instance-0000000016,1.2.0-dev
 service.state,keyword,core,,1.2.0-dev
 service.type,keyword,core,elasticsearch,1.2.0-dev
 service.version,keyword,core,3.2.4,1.2.0-dev

generated/ecs/ecs_flat.yml

@@ -3244,7 +3244,7 @@ service.ephemeral_id:
   ignore_above: 1024
   level: extended
   name: ephemeral_id
-  order: 5
+  order: 6
   short: Ephemeral identifier of this service.
   type: keyword
 service.id:
@@ -3268,16 +3268,12 @@ service.id:
 service.name:
   description: 'Name of the service data is collected from.
 
-    The name of the service is normally user given. This allows if two instances of
-    the same service are running on the same machine they can be differentiated by
-    the `service.name`.
+    The name of the service is normally user given. This allows for distributed services
+    that run on multiple hosts to correlate the related instances based on the name.
 
-    Also it allows for distributed services that run on multiple hosts to correlate
-    the related instances based on the name.
-
-    In the case of Elasticsearch the service.name could contain the cluster name.
-    For Beats the service.name is by default a copy of the `service.type` field if
-    no name is specified.'
+    In the case of Elasticsearch the `service.name` could contain the cluster name.
+    For Beats the `service.name` is by default a copy of the `service.type` field
+    if no name is specified.'
   example: elasticsearch-metrics
   flat_name: service.name
   ignore_above: 1024
@@ -3286,13 +3282,34 @@ service.name:
   order: 1
   short: Name of the service.
   type: keyword
+service.node.name:
+  description: 'Name of a service node.
+
+    This allows for two nodes of the same service running on the same host to be differentiated.
+    Therefore, `service.node.name` should typically be unique across nodes of a given
+    service.
+
+    In the case of Elasticsearch, the `service.node.name` could contain the unique
+    node name within the Elasticsearch cluster. In cases where the service doesn''t
+    have the concept of a node name, the host name or container name can be used to
+    distinguish running instances that make up this service. If those do not provide
+    uniqueness (e.g. multiple instances of the service running on the same host) -
+    the node name can be manually set.'
+  example: instance-0000000016
+  flat_name: service.node.name
+  ignore_above: 1024
+  level: extended
+  name: node.name
+  order: 2
+  short: Name of the service node.
+  type: keyword
 service.state:
   description: Current state of the service.
   flat_name: service.state
   ignore_above: 1024
   level: core
   name: state
-  order: 3
+  order: 4
   short: Current state of the service.
   type: keyword
 service.type:
@@ -3308,7 +3325,7 @@ service.type:
   ignore_above: 1024
   level: core
   name: type
-  order: 2
+  order: 3
   short: The type of the service.
   type: keyword
 service.version:
@@ -3320,7 +3337,7 @@ service.version:
   ignore_above: 1024
   level: core
   name: version
-  order: 4
+  order: 5
   short: Version of the service.
   type: keyword
 source.address:

generated/ecs/ecs_nested.yml

@@ -3672,7 +3672,7 @@ service:
       ignore_above: 1024
       level: extended
       name: ephemeral_id
-      order: 5
+      order: 6
       short: Ephemeral identifier of this service.
       type: keyword
     id:
@@ -3696,16 +3696,13 @@ service:
     name:
       description: 'Name of the service data is collected from.
 
-        The name of the service is normally user given. This allows if two instances
-        of the same service are running on the same machine they can be differentiated
-        by the `service.name`.
+        The name of the service is normally user given. This allows for distributed
+        services that run on multiple hosts to correlate the related instances based
+        on the name.
 
-        Also it allows for distributed services that run on multiple hosts to correlate
-        the related instances based on the name.
-
-        In the case of Elasticsearch the service.name could contain the cluster name.
-        For Beats the service.name is by default a copy of the `service.type` field
-        if no name is specified.'
+        In the case of Elasticsearch the `service.name` could contain the cluster
+        name. For Beats the `service.name` is by default a copy of the `service.type`
+        field if no name is specified.'
       example: elasticsearch-metrics
       flat_name: service.name
       ignore_above: 1024
@@ -3714,13 +3711,34 @@ service:
       order: 1
       short: Name of the service.
       type: keyword
+    node.name:
+      description: 'Name of a service node.
+
+        This allows for two nodes of the same service running on the same host to
+        be differentiated. Therefore, `service.node.name` should typically be unique
+        across nodes of a given service.
+
+        In the case of Elasticsearch, the `service.node.name` could contain the unique
+        node name within the Elasticsearch cluster. In cases where the service doesn''t
+        have the concept of a node name, the host name or container name can be used
+        to distinguish running instances that make up this service. If those do not
+        provide uniqueness (e.g. multiple instances of the service running on the
+        same host) - the node name can be manually set.'
+      example: instance-0000000016
+      flat_name: service.node.name
+      ignore_above: 1024
+      level: extended
+      name: node.name
+      order: 2
+      short: Name of the service node.
+      type: keyword
     state:
       description: Current state of the service.
       flat_name: service.state
       ignore_above: 1024
       level: core
       name: state
-      order: 3
+      order: 4
       short: Current state of the service.
       type: keyword
     type:
@@ -3736,7 +3754,7 @@ service:
       ignore_above: 1024
       level: core
       name: type
-      order: 2
+      order: 3
       short: The type of the service.
       type: keyword
     version:
@@ -3748,7 +3766,7 @@ service:
       ignore_above: 1024
       level: core
       name: version
-      order: 4
+      order: 5
       short: Version of the service.
       type: keyword
   group: 2

generated/elasticsearch/6/template.json

@@ -1383,6 +1383,14 @@
               "ignore_above": 1024, 
               "type": "keyword"
             }, 
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024, 
+                  "type": "keyword"
+                }
+              }
+            }, 
             "state": {
               "ignore_above": 1024, 
               "type": "keyword"

generated/elasticsearch/7/template.json

@@ -1382,6 +1382,14 @@
             "ignore_above": 1024, 
             "type": "keyword"
           }, 
+          "node": {
+            "properties": {
+              "name": {
+                "ignore_above": 1024, 
+                "type": "keyword"
+              }
+            }
+          }, 
           "state": {
             "ignore_above": 1024, 
             "type": "keyword"

generated/legacy/template.json

@@ -907,6 +907,14 @@
               "ignore_above": 1024,
               "type": "keyword"
             },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
             "state": {
               "ignore_above": 1024,
               "type": "keyword"

schema.json

@@ -2168,7 +2168,7 @@
         "type": "keyword"
       }, 
       "service.name": {
-        "description": "Name of the service data is collected from.\nThe name of the service is normally user given. This allows if two instances of the same service are running on the same machine they can be differentiated by the `service.name`.\nAlso it allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the service.name could contain the cluster name. For Beats the service.name is by default a copy of the `service.type` field if no name is specified.", 
+        "description": "Name of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.", 
         "example": "elasticsearch-metrics", 
         "footnote": "", 
         "group": 2, 
@@ -2177,6 +2177,16 @@
         "required": false, 
         "type": "keyword"
       }, 
+      "service.node.name": {
+        "description": "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", 
+        "example": "instance-0000000016", 
+        "footnote": "", 
+        "group": 2, 
+        "level": "extended", 
+        "name": "service.node.name", 
+        "required": false, 
+        "type": "keyword"
+      }, 
       "service.state": {
         "description": "Current state of the service.", 
         "example": "",