Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Harmonize hostname, and move to domain + full_domain #141

Closed
wants to merge 5 commits into from

Conversation

webmat
Copy link
Contributor

@webmat webmat commented Oct 22, 2018

  • Gets rid of the last instances of host.name
  • Moves to the new standard of domain + full_domain everywhere, including
    under url.
  • I added a comment on source & destination's .hostname field. A local agent
    is unlikely to be able to populate this reliably (at best its side of the
    connection). It's expected to be added in as an enrichment. It's also a cue
    that it may be omitted in cases where operational monitoring is the goal,
    rather than security.

Closes #84

This adds the note to the readme and fields.yml
@webmat
Copy link
Contributor Author

webmat commented Oct 23, 2018

We're moving from full_domain to fqdn

@webmat
Copy link
Contributor Author

webmat commented Oct 23, 2018

@ruflin Ok, host.name commit has been extracted out to #144 :-)

url.fragment,keyword,0,
url.host.name,keyword,0,elastic.co
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can't remove the hostname here but should rename it to url.hostname. These entries are pretty standard for url_parsers across various languages.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that the field url.host.name needs to change to something else. But I disagree that it should become url.hostname.

Please read #84 (comment) to understand why I'd rather introduce domain here instead of hostname.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The url.hostname is what shows up in the url. It could also be an ip address.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the record, @ruflin won me over, at least for url.hostname: #147.

The deciding argument was that a URL can either have a domain name or an IP there. So using the word domain was not suitable.

@webmat
Copy link
Contributor Author

webmat commented Oct 24, 2018

Closing this. host.hostname and url.hostname have been dealt with in #144 and #147 respectively. Also latest discussions have made clear that domain & full_domain were not necessarily the best naming for these fields. Let's wait for consensus to emerge in #84.

@webmat webmat closed this Oct 24, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants