elastic / elastic/integrations

Elasticsearch integration triggering "Agent Spoofing - Multiple Hosts Using Same Agent"

Open
#13,142 0 comments 0 reactions 0 assignees View on GitHub
Integration:elasticsearch Team:Stack Monitoring
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

Overwriting host.id with elasticsearch.node.id can lead to different host.id values, since not all logs from elasticsearch contains this field, as also other integrations doesn't contain.

I found two log source that are overwriting:

https://github.com/elastic/integrations/blob/2ebb1ace46230837fc03fa64e58c4e9cba11795c/packages/elasticsearch/data_stream/deprecation/elasticsearch/ingest_pipeline/default.yml#L30

https://github.com/elastic/integrations/blob/main/packages/elasticsearch/data_stream/server/elasticsearch/ingest_pipeline/default.yml#L74

Maybe leveraging the host.id field to that populated by elastic_agent could avoid this issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.