Hi, Im using the Filebeat 7.6.0 to parse CEF logs from our ArcSight SmartConnector. I've noticed that agent.hostname and agent.name is incorrectly set. Agent.name should not be the hostname of the host where the SmartConnector is running, but the actual name that is configured for the SmartConnector. And agent.hostname is reporting the hostname of the host that actually created the log, the original sender, which is incorrect. agent.hostname should be the hostname of the host that is running the SmartConnector (same as cef.extensions.agentHostName).
Anyone else noticed this?