[Fleet]: Hostnames are visible with lower case letters when actually set in Upper case.

[amolnater-qasource]

Kibana Build details:

VERSION: 8.9.0 Snapshot
BUILD: 63944
COMMIT: 9d6846d9e259192dd968c503fac40c44d42c13b9

Host OS and Browser version: Windows, All

Preconditions:

1. 8.9.0 SNAPSHOT Kibana cloud environment should be available.
2. Few Agents should be installed.

Steps to reproduce:

1. Navigate to Fleet>Agents tab.
2. Observe host names are visible with lower case.
   • Issue is specifically reproducible with 8.9 artifacts.

Expected:
Hostnames should be visible with upper case letters when actually set in upper case.

Screenshots:

What's working:

• Hostnames are showing in upper case if the lower version agents are installed on same host.

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[amolnater-qasource]

@manishgupta-qasource Please review.

[manishgupta-qasource]

Secondary review for this ticket is Done

[cmacknz]

I think this is because of elastic/elastic-agent#2767 and the related change in Beats.

The original PR was elastic/go-sysinfo#180, ECS recommends the FQDN hostname always be in lowercase. This was an intentional change.

[cmacknz]

Looking at the screenshot this change results in duplicate agents in the UI doesn't it?

DNS hostnames are not case sensitive, I think this could be considered a bug in how the UI does hostname comparisons. We could also categorize this as a breaking change how the agent and Beats report hostnames, but they technically should not be case sensitive.

CC @jlind23 @juliaElastic @ycombinator

[amolnater-qasource]

Hi @cmacknz

Thank you for looking into this issue.

Just to avoid confusion, we have installed agents on the same host, uninstalling them(not unenrolling from the UI) and then reinstalling for better comparisons. There are no duplicate agents due to any issue in the UI.

The issue is just with 8.9.0 agents host name[not set to FQDN] getting in lower case.

Screenshot:

Please let us know if we are missing anything here.

Thanks!

[jlind23]

@amolnater-qasource if there are no duplicates then I think we can close this issue as this is not a bug but rather a change introduced by elastic/go-sysinfo#180.
As this change won't be rolled back we only have two options:

• Don't do anything
• Create a doc entry stating that from 8.9 on the hostname is going to always be lower case.

[amolnater-qasource]

Thank you for the confirmation @jlind23

We have further observed that these changes aren't available under Endpoints tab:

Two different names are visible for same host under HOSTS tab:

Data with two different names is visible for same host under Discover tab on adding Elastic Defend:

Could anyone please confirm if this is expected too?

Thank you!

[jlind23]

Endpoint team has its own way of returning FQDN value @nfritts are you planning on lowercasing hostname just like recommended at https://www.elastic.co/guide/en/ecs/current/ecs-host.html#field-host-name?

[The host.name field] can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.

[nfritts]

@jlind23 Yes. We treat any result from endpoint that doesn't match the agent output as a bug. we have tests to detect this and while looking in to this I learned that we basically don't have any machines with capital letters in them that run the tests.

We'll have it fixed in 8.9.

[jlind23]

@amolnater-qasource can we close this issue as it seems to be an endpoint specific one?

[amolnater-qasource]

Hi @jlind23

Thank you for resolving this.

Yes, as the issue is just related to Endpoint specific now, we are closing this.

Thanks!