-
Notifications
You must be signed in to change notification settings - Fork 418
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Harmonize hostname, and move to domain + full_domain #141
Conversation
This adds the note to the readme and fields.yml
We're moving from |
url.fragment,keyword,0, | ||
url.host.name,keyword,0,elastic.co |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We can't remove the hostname here but should rename it to url.hostname
. These entries are pretty standard for url_parsers across various languages.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I agree that the field url.host.name
needs to change to something else. But I disagree that it should become url.hostname
.
Please read #84 (comment) to understand why I'd rather introduce domain
here instead of hostname
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The url.hostname is what shows up in the url. It could also be an ip address.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
host.name
domain
+full_domain
everywhere, includingunder
url.
.hostname
field. A local agentis unlikely to be able to populate this reliably (at best its side of the
connection). It's expected to be added in as an enrichment. It's also a cue
that it may be omitted in cases where operational monitoring is the goal,
rather than security.
Closes #84