I am running a filebeat 7.14.1 in a docker container on a debian host. I am using the modules
system. The filbeat is sending the documents directly to elasticsearch, those are my ingest nodes with the according piplines belonging to the filebeat modules
I excpeted that the ECS field
host.name would be created, but it is missing. This lead also into the fact that they are not respected in the kibana security integration on page
/app/security/hosts/allHosts? cause the requests there are based on the field presence of
All components are in version 7.14.1.
Configuration can be find here:
Does anyone hava a idea? I can not find a related issue for that.