[Security Solution] Fix host details query when missing IP

[patrykkopycinski]

Summary

Error

{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "encoded bytes are of incorrect length"
      }
    ],
    "type" : "illegal_argument_exception",
    "reason" : "encoded bytes are of incorrect length",
    "caused_by" : {
      "type" : "unknown_host_exception",
      "reason" : "addr is of illegal length"
    }
  },
  "status" : 400
}

Query

GET _search
{
    "aggregations": {
      "host_ip": {
        "terms": {
          "field": "host.ip",
          "size": 10,
          "order": {
            "timestamp": "desc"
          }
        },
        "aggs": {
          "timestamp": {
            "max": {
              "field": "@timestamp"
            }
          }
        }
      }
    },
    "query": {
      "bool": {
        "filter": [
          {
            "term": {
              "host.name": "siem-kibana"
            }
          },
          {
            "range": {
              "@timestamp": {
                "format": "strict_date_optional_time",
                "gte": "2020-09-29T07:25:51.161Z",
                "lte": "2020-09-30T07:25:51.161Z"
              }
            }
          }
        ]
      }
    }
}

Solution
elastic/elasticsearch#27788

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[patrykkopycinski]

@elasticmachine merge upstream

[patrykkopycinski]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 129ac45

Metrics [docs]

✅ unchanged

History

• 💛 Build #79069 was flaky 6bdb796
• 💚 Build #78524 succeeded 7433355
• 💔 Build #78469 failed 63c8801
• 💔 Build #78203 failed d1e7634
• 💔 Build #78189 failed 3bed15a

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)