[Infra] Hosts view show up duplicate hosts

[cauemarcondes]

I'm running on my local environment the APM agent and Metricbeats, and when I open the hosts view I see my local host twice.

This becomes more problematic as I cannot correlate APM services running on that host.

[elasticmachine]

Pinging @elastic/obs-ux-infra_services-team (Team:obs-ux-infra_services)

[roshan-elastic]

Thanks for this @cauemarcondes. I'm trying to get a sense of scale/impact here...do we know when this happens?

e.g. does this happen every time a host name is not all lower-case? (e.g. an EC2 instance which isn't entered as lower-case)

@smith do you think this is something we should try and address or should we be asking the APM agent team / normal agent teams to be consistent?

[crespocarlos]

The query would have to run a terms aggs that is case insensitive if we want to remove duplicates at query level. Probably the best solution would be if APM agents and metricbeat shipped the same host.name.

[smith]

I've opened elastic/beats#38689 and am closing this. The host name is case sensitive and should not be modified by agents.

[trentm]

@cauemarcondes Do you know which APM agent(s) and Beat(s) were reporting those host.name values?
E.g. can you show agent.* values for the Elasticsearch documents with those two variants of the host.name value?

[cauemarcondes]

Do you know which APM agent(s) and Beat(s) were reporting those host.name values?

I used the APM GO (github.com/gin-gonic/gin v1.9.1) agent and metricbeat-8.12.1-darwin-x86_64

[roshan-elastic]

@smith - should we reopen this and add it to the backlog in either HCS phase I or phase II?

Wondering which phase it makes sense to be done in?

As a user, I'd want it to be part of phase I given other deliverables in the acceptance criteria but I don't know if that's realistic.

[smith]

@roshan-elastic the UI problem is a side-effect of the data problem which is being solved between beats, APM, and Otel agents. A UI fix would be counter-productive and we should leave this closed.

Additionally, we haven't seen any reports from customers having this problem in production environments.