elastic / elastic/integrations
Elasticsearch integration triggering "Agent Spoofing - Multiple Hosts Using Same Agent"
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
Overwriting host.id with elasticsearch.node.id can lead to different host.id values, since not all logs from elasticsearch contains this field, as also other integrations doesn't contain.
I found two log source that are overwriting:
https://github.com/elastic/integrations/blob/2ebb1ace46230837fc03fa64e58c4e9cba11795c/packages/elasticsearch/data_stream/deprecation/elasticsearch/ingest_pipeline/default.yml#L30
https://github.com/elastic/integrations/blob/main/packages/elasticsearch/data_stream/server/elasticsearch/ingest_pipeline/default.yml#L74
Maybe leveraging the host.id field to that populated by elastic_agent could avoid this issue.
Contributor guide
Assessment
This issue has not been assessed yet.