Endpoint Agent two host showing in logs-* per host

[The1WhoPrtNocks]

Re-created with elastic-agent tag for better visibility.

Hi,

I have recently been rolling out the Endpoint agent to some host for testing.
Within the fleet agents tab, there is a single entry for each host in the format "hostname".

However within the logs-* index there are two host names for each host in the following formats, "hostname" and "hostname.domain.name.here" .

This is then showing as two separate hosts under the SIEM hosts location.

Any idea as to what could be causing this ?

Thanks in advance

[mtojek (Marcin Tojek)]

Would you mind posting a Kibana screenshot and/or dump of Elasticsearch index (relevant dumps)?

[The1WhoPrtNocks]

Hi @mtojek,

Thanks for getting back to me.

Below is the list of test agents I have deployed using fleet.

Here is a screen grab from the logs-* index , you can see i could filter by host.hostname:"IPPLAP067" but IPPLAP067.ipperf.local is also available in the index

Finally here is the data in the SIEM app which pulls from this log clearly showing the two host names also with different features.