elastic / elastic/endpoint-package

Missing agent.name field

Open
#298 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
33
Forks
20
Avg merge
2d 16h
Merged PRs (30d)
5

Description

Hi,

The endpoint datastreams are missing the `agent.name` field in the documents. Normally any document ingested by Elastic Agent using an Integration has `agent.name` available.

For some datastreams `agent.name` already exists in the mapping:
https://github.com/elastic/endpoint-package/blob/master/package/endpoint/data_stream/process/fields/fields.yml#L50

Contributor guide

No contributing guide indexed for this repository

Research direction

Review package/endpoint/data_stream/process/fields/fields.yml and start with the existing agent.name mapping referenced in the issue. Compare the datastream mappings to identify which ones lack the field; done means the affected ingested documents expose agent.name consistently.

Written by the indexing model from the issue text.

Assessment

Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.