Add replace_fields config option in add_host_metadata for replacing host fields

CHANGELOG.next.asciidoc

@@ -19,6 +19,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Make error message about locked data path actionable. {pull}18667[18667]
 - Ensure dynamic template names are unique for the same field. {pull}18849[18849]
 - Remove the deprecated `xpack.monitoring.*` settings. Going forward only `monitoring.*` settings may be used. {issue}9424[9424] {pull}18608[18608]
+- Change add_host_metadata to not overwrite if host fields already exist. {pull}20490[20490] {issue}20464[20464]
 
 *Auditbeat*
 

libbeat/processors/add_host_metadata/add_host_metadata.go

@@ -81,6 +81,12 @@ func New(cfg *common.Config) (processors.Processor, error) {
 
 // Run enriches the given event with the host meta data
 func (p *addHostMetadata) Run(event *beat.Event) (*beat.Event, error) {
+	// If host fields exist(besides host.name added by libbeat) in event, skip add_host_metadata.
+	hostFields, _ := event.Fields.GetValue("host")
+	if hostFields != nil && len(hostFields.(common.MapStr)) > 1 {
+		return event, nil
+	}
+
 	err := p.loadData()
 	if err != nil {
 		return nil, err

libbeat/processors/add_host_metadata/add_host_metadata_test.go

@@ -31,6 +31,8 @@ import (
 	"github.com/elastic/go-sysinfo/types"
 )
 
+var hostName = "testHost"
+
 func TestConfigDefault(t *testing.T) {
 	event := &beat.Event{
 		Fields:    common.MapStr{},
@@ -196,3 +198,66 @@ func TestConfigGeoDisabled(t *testing.T) {
 	assert.Error(t, err)
 	assert.Equal(t, nil, eventGeoField)
 }
+
+func TestEventWithExistingHostField(t *testing.T) {
+	hostID := "9C7FAB7B"
+	event := &beat.Event{
+		Fields: common.MapStr{
+			"host": common.MapStr{
+				"name": hostName,
+				"id":   hostID,
+			},
+		},
+		Timestamp: time.Now(),
+	}
+	testConfig, err := common.NewConfigFrom(map[string]interface{}{})
+	assert.NoError(t, err)
+
+	p, err := New(testConfig)
+	switch runtime.GOOS {
+	case "windows", "darwin", "linux":
+		assert.NoError(t, err)
+	default:
+		assert.IsType(t, types.ErrNotImplemented, err)
+		return
+	}
+
+	newEvent, err := p.Run(event)
+	assert.NoError(t, err)
+
+	v, err := newEvent.GetValue("host")
+	assert.NoError(t, err)
+
+	hostFields := v.(common.MapStr)
+	assert.Equal(t, 2, len(hostFields))
+	assert.Equal(t, hostID, hostFields["id"])
+}
+
+func TestEventWithoutHostFields(t *testing.T) {
+	event := &beat.Event{
+		Fields: common.MapStr{
+			"host": common.MapStr{
+				"name": hostName,
+			},
+		},
+		Timestamp: time.Now(),
+	}
+	testConfig, err := common.NewConfigFrom(map[string]interface{}{})
+	assert.NoError(t, err)
+
+	p, err := New(testConfig)
+	switch runtime.GOOS {
+	case "windows", "darwin", "linux":
+		assert.NoError(t, err)
+	default:
+		assert.IsType(t, types.ErrNotImplemented, err)
+		return
+	}
+
+	newEvent, err := p.Run(event)
+	assert.NoError(t, err)
+
+	v, err := newEvent.GetValue("host")
+	assert.NoError(t, err)
+	assert.True(t, len(v.(common.MapStr)) > 1)
+}

libbeat/processors/add_host_metadata/docs/add_host_metadata.asciidoc

@@ -75,3 +75,6 @@ The fields added to the event look like the following:
    }
 }
 -------------------------------------------------------------------------------
+
+Note: `add_host_metadata` processor will not overwrite host fields if `host.*`
+fields already exist in the event from Beats.