Mac hostname showing as "localhost"

[rsaeks]

I've been running into an interesting issue and it sounds like in the past there was a similar challenge running a beat on a mac. In my case this is filebeat, but the symptom is the same as @DPattee reported here:

Mac hostname showing as 'localhost'

Two Mac OS X machines set up to report statistics via TopBeat 1.2.1 (amd64). One of those machines is the one that Elastic runs on. Same topbeat config file on both machines. The elastic search: hosts: line is set to the ip address (http://nn.nn.nn.nn:9200), neither is using the default "localhost" option. The shipper: name: line is left commented out so that each machine should automatically report the hostname. One machine, the remote one running OS X 10.11.4, correctly reports the beat.h…

I'm using a launchDaemon to start filebeat at system startup. When this happens machines seem to want to report back "localhost" as the machine name via filebeat even though all other system tools show the proper hostname.

Sure enough, as soon as I kill filebeat (and it re-launches) the proper hostname begins reporting back. I wasn't sure if anyone has put together a workaround other than restarting the agent, but wanted to share one I've done:

As part of the filebeat install we run a postinstall script to add in and load the launchDaemon. I added in a line of code to:

echo "name: "hostname | cut -d "." -f1 >> /usr/local/filebeat/filebeat.yml

This puts sets what eventually appears as beat.name to the machine name trimming out .local and stores the data into the filebeat.yml config file.

Hope this helps some and if there are some better ways I'm happy to hear!

[andrewkroh]

Probably the beat is starting before the networking system is fully up. I think all Beats only retrieve the hostname once at startup. It might make sense to have to Beat periodically check to see if the hostname has changed.