Make it possible to disable host metadata #17919
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This provides a way to disable the addition of host metadata without introducing a breaking change. By setting @metadata.internal.distable_host_metadata=true in an event this will disable the addition of host.name by libbeat and disable add_host_metadata if it exists in the pipeline. This can be removed in 8.0 if we disable host.name is libbeat and modify how the default configurations.
The PANW module always forwards data from another device so Filebeat should not set the host fields.
andrewkroh
force-pushed
the
feature/add-host-metadata-overwrite
branch
from
3d01296
to
04706b0
Compare
andrewkroh
changed the title
|
Pinging @elastic/integrations (Team:Integrations) |
|
One can 'disable' adding 'Host' altogether when constructing a Beat. Where would you use this changes? I'd prefer if we can do without this feature. Instead of adding some magic fields to |
💔 Build Failed
Expand to view the summary
Build stats
Test stats 🧪
Test errorsExpand to view the tests failures
Steps errorsExpand to view the steps failures
Log outputExpand to view the last 100 lines of log output
|
|
I'm going to close this change. I made a smaller change to add a Filebeat input setting to disable |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This provides a way to disable the addition of host metadata without introducing a breaking change. By setting
@metadata.internal.distable_host_metadata=truein an event this will disable the addition ofhost.nameby libbeat and disableadd_host_metadataif it exists in the pipeline.This can be removed in 8.0 if/when we disable
host.nameis libbeat and modify the default Beat configurations.Why is it important?
ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Some data sources only forward data and it would be incorrect to set
host.*fields.Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Related issues
Relates #13920