Mac hostname showing as 'localhost'

Elastic Stack Beats
1

Two Mac OS X machines set up to report statistics via TopBeat 1.2.1 (amd64).
One of those machines is the one that Elastic runs on.

Same topbeat config file on both machines.
The elastic search: hosts: line is set to the ip address (http://nn.nn.nn.nn:9200), neither is using the default "localhost" option.
The shipper: name: line is left commented out so that each machine should automatically report the hostname.

One machine, the remote one running OS X 10.11.4, correctly reports the beat.hostname and beat.name as "Foo.local"

The other machine, the one where Elastic is running under OS X 10.10.5, incorrectly reports both of those as "localhost"

Running the hostname command on both machines correctly prints out their names. (i.e. Foo.local and Bar.local)

2

On OSX (and all BSD platforms), Golang reports the hostname using the sysctl kern.hostname value. So check the output of that command.

Reference: https://golang.org/src/os/sys_bsd.go

3

Just verified - that command also shows the correct information on both the 10.11 and 10.10 systems.

( the same data as bin/hostname -f, i.e. Foo.local, and Bar.local)

4

Maybe you could so a simple test with just Golang on your machine. I can't come up with a reason why beat.hostname == localhost.

macbook13:tmp akroh$ go version
go version go1.6.2 darwin/amd64
macbook13:tmp akroh$ sysctl kern.hostname
kern.hostname: macbook13.company.com
macbook13:tmp akroh$ cat main.go
package main

import (
	"fmt"
	"os"
)

func main() {
	fmt.Println(os.Hostname())
}
macbook13:tmp akroh$ go run main.go
macbook13.company.com <nil>

As you can see on this line the publisher.hostname is being set to the value of os.Hostname().

5

It seems the problem is a bit more insidious than I expected.

hostname, sysctl kern.hostname, and the Go function os.Hostname all return the correct results when run from the command line. Running it just as the logged in user or via sudo.

Topbeat also post the correct beat.hostname when run from the command line.

Run topbeat as a daemon at startup as root with the same command line parameters / config file? You start getting the 'localhost' results.

Until... you ssh in to the box, sudo kill and allow launchd to automatically restart the process (have KeepAlive in your plist) at which point it starts reporting the correct machine name.