elastic / elastic/integrations

[FR] Add `host.name` field to Traefik Access Logs Integration

Open
#17,900 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

## Summary
The [Traefik Access Logs integration](https://www.elastic.co/docs/reference/integrations/traefik) does not have the `host.name` field populated, which forces us (when writing detection-rules) to fallback to the `agent.name` field.

When adding `Traefik` support to our detection rules, we had to modify all existing access log rules to move over from `host.name` to `agent.name`. This is not desired.

* https://github.com/elastic/detection-rules/pull/5849

The ask:

* If possible, please add `host.name` to the `Traefik` integration.

```
{
"@timestamp": "2024-02-09T11:53:32.609696286Z",
"destination": {
"address": "10.1.25.243",
"ip": "10.1.25.243",
"port": 80
},
"ecs": {
"version": "8.11.0"
},
"event": {
"category": [
"web"
],
"created": "2020-04-28T11:07:58.223Z",
"duration": 59518533,
"ingested": "2024-02-13T16:08:40.190327617Z",
"kind": "event",
"original": "{\"ClientAddr\": \"10.10.8.105:48376\",\"ClientHost\": \"175.16.199.10\",\"ClientPort\": \"48376\",\"ClientUsername\": \"-\",\"DownstreamContentSize\": 88,\"DownstreamStatus\": 200,\"Duration\": 59518533,\"OriginContentSize\": 88,\"OriginDuration\": 59428568,\"OriginStatus\": 200,\"Overhead\": 89965,\"RequestAddr\": \"api-students.unpad.ac.id\",\"RequestContentSize\": 0,\"RequestCount\": 75,\"RequestHost\": \"api-students.unpad.ac.id\",\"RequestMethod\": \"GET\",\"RequestPath\": \"/api/v1/study/140410210038/card/comment\",\"RequestPort\": \"-\",\"RequestProtocol\": \"HTTP/1.0\",\"RequestScheme\": \"http\",\"RetryAttempts\": 0,\"RouterName\": \"app-unpad-students-api-prod-app-unpad-students-api-api-students-unpad-ac-id-api@kubernetes\",\"ServiceAddr\": \"10.1.25.243:80\",\"ServiceName\": \"app-unpad-students-api-prod-app-unpad-students-api-80@kubernetes\",\"ServiceURL\": {\"Scheme\": \"http\",\"Opaque\": \"\",\"User\": null,\"Host\": \"10.1.25.243:80\",\"Path\": \"\",\"RawPath\": \"\",\"OmitHost\": false,\"ForceQuery\": false,\"RawQuery\": \"\",\"Fragment\": \"\",\"RawFragment\": \"\"},\"StartLocal\": \"2024-02-09T11:53:32.609696286Z\",\"StartUTC\": \"2024-02-09T11:53:32.609696286Z\",\"entryPointName\": \"web\",\"level\": \"info\",\"msg\": \"\",\"time\": \"2024-02-09T11:53:32Z\"}",
"outcome": "success",
"type": [
"access"
]
},
"http": {
"request": {
"body": {
"bytes": 0
},
"method": "GET"
},
"response": {
"body": {
"bytes": 88
},
"status_code": 200
},
"version": "1.0"
},
"log": {
"level": "info"
},
"network": {
"community_id": "1:Mgo2d5qbyedZ2JnxvcBh0BuPcWk=",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "app-unpad-students-api-prod-app-unpad-students-api-80@kubernetes"
}
},
"ingress": {
"interface": {
"name": "web"
}
},
"product": "traefik",
"type": "proxy",
"vendor": "traefik"
},
"related": {
"ip": [
"10.10.8.105",
"10.1.25.243"
]
},
"source": {
"address": "10.10.8.105:48376",
"ip": "10.10.8.105",
"port": 48376
},
"tags": [
"preserve_original_event"
],
"traefik": {
"access": {
"origin": {
"content_size": 88,
"duration": 59428568,
"status_code": 200
},
"overhead": 89965,
"request_count": 75,
"retry_attempts": 0,
"router": {
"name": "app-unpad-students-api-prod-app-unpad-students-api-api-students-unpad-ac-id-api@kubernetes"
},
"service": {
"url": {
"domain": "10.1.25.243:80",
"force_query": false,
"fragment": "",
"opaque": "",
"path": "",
"raw_path": "",
"raw_query": "",
"user": null
}
}
}
},
"url": {
"domain": "api-students.unpad.ac.id",
"original": "/api/v1/study/140410210038/card/comment",
"scheme": "http"
},
"user": {
"name": "-"
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.