elastic / elastic/integrations
[Fortinet Fortigate]: Space added to host.name field sometimes.
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Fortinet FortiGate Firewall Logs [fortinet_fortigate]
### Dataset Name
fortinet_fortigate.log
### Integration Version
1.33.0
### Agent Version
8.17.7
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.17.7
### OS Version and Architecture
Cloud Deployment
### Software/API Version
_No response_
### Error Message
No explicit error but here is a description:
The host.name field is being parsed inconsistently: some log entries include a trailing space (“laptop-01 ”), while others omit it (“laptop-01”). As a result, dashboards and alerts split the same host into two entities, and event counts appear fragmented.
### Event Original
_No response_
### What did you do?
No special configuration
### What did you see?
A subset of events is indexed under host.name = "laptop-01 " (note the trailing space).
The remaining events for the same machine are indexed under host.name = "laptop-01" (no trailing space).
Combined, both buckets account for all expected events, indicating that only the trailing space differs.
### What did you expect to see?
All events from the same host should be parsed into a single, consistent host.name value (e.g., "laptop-01"), with no trailing whitespace.
### Anything else?
The host.name field is being parsed inconsistently: some log entries include a trailing space (“laptop-01 ”), while others omit it (“laptop-01”). As a result, dashboards and alerts split the same host into two entities, and event counts appear fragmented.
These are the daily logs for the laptop with a space in the host.name:
These are the daily logs for the laptop without a space in the host.name:
Contributor guide
Assessment
This issue has not been assessed yet.