Host.name field winlogbeat (FQDN) vs filebeat (shortname)

Elastic Stack Beats
1

I have built a brand new 7.6.2 cluster and I am testing SIEM with it as well as making some changes in the architecture and index layout from my old 6.x cluster I have updated a few times.

I have a windows system where I have auditbeat and winlogbeat installed and sending directly to the ES cluster as an output. I have noticed that the host.name field is set to the FQDN from winlogbeat, and the short name is used with auditbeat. This causes the SIEM dashboard to see 2 hosts one with FQDN and one with short name due to the host.name field being different.

I have looked at the logs and the "Beat name:" is set to the short name for both beats.

Is there a way to make the host.name field the shortname of the host fro auditbeat on a windows system?

2

Hi,

Just to confirm I am experiencing this problem too.
I have recently upgraded to 7.6.2 beats from 7.5.0, and I am seeing the same behaviour where winlogbeat sends the FQDN in the host.name field, and all other beats send just the hostname.