Lowercase host.name FQDN Beta Fleet policy setting

Elastic Stack Kibana
1

Hello,

We are working through an effort to make sure host.name is indexed as lowercase fqdn everywhere. We put the original hostname in host.hostname.

Considering we have multiple domains, this is not only necessary to avoid host collision problems, but it also allows us to correlate host datasets with network datasets. We have 200+ datasets and some of them are logging camelcase, other uppercase, others lowercase, so there is also a requirement to lowercase the host.name everywhere.

image
image1452×1718 273 KB

Host Fields | Elastic Common Schema (ECS) Reference [8.11] | Elastic

image
image1068×494 35.5 KB

But the Host Name format is still showing as Beta in the Fleet policy settings. Is there a plan to make it GA and also update the example to lowercase + effectively lowercase the host name value?

Thanks.

WillemD

1 Like
2

Hi,

maybe you can use a lowercase processor in an Elasticsearch ingest pipeline to convert the host.name field to lowercase.

Regards

1 Like
3

Hi @yago82

Everything can be custom made, but the feature exists .. in Beta. ECS says its the recommended value. We would like to see this become ga and supported so this can be a part of our long term logging and correlation strategy.

Grtz

Willem

4

Hi,

thank you for the clarification

Regards

1 Like