Change url.host.name to url.hostname (#8732)

This update the Filebeat Suricata module to use url.hostname instead of url.host.name.
elastic · Oct 24, 2018 · ff8f674 · ff8f674
1 parent 1da9636
commit ff8f674
Show file tree

Hide file tree

Showing 16 changed files with 52 additions and 52 deletions.
diff --git a/auditbeat/docs/fields.asciidoc b/auditbeat/docs/fields.asciidoc
@@ -4305,15 +4305,15 @@ Note: The `:` is not part of the scheme.
 
 --
 
-*`url.host.name`*::
+*`url.hostname`*::
 +
 --
 type: keyword
 
 example: elastic.co
 
-Hostname of the request, such as "example.com".
-For correlation the this field can be copied into the `host.name` field.
+Hostname of the request, such as "elastic.co".
+In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `hostname` field.
 
 
 --

diff --git a/auditbeat/include/fields.go b/auditbeat/include/fields.go
diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc
@@ -2335,15 +2335,15 @@ Note: The `:` is not part of the scheme.
 
 --
 
-*`url.host.name`*::
+*`url.hostname`*::
 +
 --
 type: keyword
 
 example: elastic.co
 
-Hostname of the request, such as "example.com".
-For correlation the this field can be copied into the `host.name` field.
+Hostname of the request, such as "elastic.co".
+In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `hostname` field.
 
 
 --

diff --git a/filebeat/include/fields.go b/filebeat/include/fields.go
diff --git a/heartbeat/docs/fields.asciidoc b/heartbeat/docs/fields.asciidoc
@@ -1870,15 +1870,15 @@ Note: The `:` is not part of the scheme.
 
 --
 
-*`url.host.name`*::
+*`url.hostname`*::
 +
 --
 type: keyword
 
 example: elastic.co
 
-Hostname of the request, such as "example.com".
-For correlation the this field can be copied into the `host.name` field.
+Hostname of the request, such as "elastic.co".
+In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `hostname` field.
 
 
 --

diff --git a/heartbeat/include/fields.go b/heartbeat/include/fields.go
diff --git a/libbeat/_meta/fields.ecs.yml b/libbeat/_meta/fields.ecs.yml
@@ -974,13 +974,13 @@
     
             Note: The `:` is not part of the scheme.
           example: https
-        - name: host.name
+        - name: hostname
           type: keyword
           description: >
-            Hostname of the request, such as "example.com".
-    
-            For correlation the this field can be copied into the `host.name`
-            field.
+            Hostname of the request, such as "elastic.co".
+
+            In some cases a URL may refer to an IP and/or port directly, without a
+            domain name. In this case, the IP address would go to the `hostname` field.
           example: elastic.co
         - name: port
           type: integer

diff --git a/metricbeat/docs/fields.asciidoc b/metricbeat/docs/fields.asciidoc
@@ -4923,15 +4923,15 @@ Note: The `:` is not part of the scheme.
 
 --
 
-*`url.host.name`*::
+*`url.hostname`*::
 +
 --
 type: keyword
 
 example: elastic.co
 
-Hostname of the request, such as "example.com".
-For correlation the this field can be copied into the `host.name` field.
+Hostname of the request, such as "elastic.co".
+In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `hostname` field.
 
 
 --

diff --git a/metricbeat/include/fields/fields.go b/metricbeat/include/fields/fields.go
diff --git a/packetbeat/docs/fields.asciidoc b/packetbeat/docs/fields.asciidoc
@@ -3806,15 +3806,15 @@ Note: The `:` is not part of the scheme.
 
 --
 
-*`url.host.name`*::
+*`url.hostname`*::
 +
 --
 type: keyword
 
 example: elastic.co
 
-Hostname of the request, such as "example.com".
-For correlation the this field can be copied into the `host.name` field.
+Hostname of the request, such as "elastic.co".
+In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `hostname` field.
 
 
 --

diff --git a/packetbeat/include/fields.go b/packetbeat/include/fields.go
diff --git a/winlogbeat/docs/fields.asciidoc b/winlogbeat/docs/fields.asciidoc
@@ -1783,15 +1783,15 @@ Note: The `:` is not part of the scheme.
 
 --
 
-*`url.host.name`*::
+*`url.hostname`*::
 +
 --
 type: keyword
 
 example: elastic.co
 
-Hostname of the request, such as "example.com".
-For correlation the this field can be copied into the `host.name` field.
+Hostname of the request, such as "elastic.co".
+In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `hostname` field.
 
 
 --

diff --git a/winlogbeat/include/fields.go b/winlogbeat/include/fields.go
diff --git a/x-pack/filebeat/module/suricata/eve/ingest/pipeline.json b/x-pack/filebeat/module/suricata/eve/ingest/pipeline.json
@@ -49,7 +49,7 @@
     }
   , {"convert":
       {"field": "suricata.eve.http.hostname"
-      ,"target_field": "url.host.name"
+      ,"target_field": "url.hostname"
       ,"type": "string"
       ,"ignore_missing": true
       }

diff --git a/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json b/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json
@@ -54,7 +54,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "example.net", 
+        "url.hostname": "example.net", 
         "user_agent.device": "Other", 
         "user_agent.major": "7", 
         "user_agent.minor": "58", 
@@ -118,7 +118,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "example.net", 
+        "url.hostname": "example.net", 
         "user_agent.device": "Other", 
         "user_agent.major": "7", 
         "user_agent.minor": "58", 
@@ -182,7 +182,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "example.net", 
+        "url.hostname": "example.net", 
         "user_agent.device": "Other", 
         "user_agent.major": "7", 
         "user_agent.minor": "58", 
@@ -246,7 +246,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "example.org", 
+        "url.hostname": "example.org", 
         "user_agent.device": "Other", 
         "user_agent.major": "7", 
         "user_agent.minor": "58", 
@@ -310,7 +310,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "example.org", 
+        "url.hostname": "example.org", 
         "user_agent.device": "Other", 
         "user_agent.major": "7", 
         "user_agent.minor": "58", 
@@ -374,7 +374,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "example.org", 
+        "url.hostname": "example.org", 
         "user_agent.device": "Other", 
         "user_agent.major": "7", 
         "user_agent.minor": "58", 
@@ -437,7 +437,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "security.ubuntu.com", 
+        "url.hostname": "security.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -499,7 +499,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "archive.ubuntu.com", 
+        "url.hostname": "archive.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -561,7 +561,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "archive.ubuntu.com", 
+        "url.hostname": "archive.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -623,7 +623,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "security.ubuntu.com", 
+        "url.hostname": "security.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -685,7 +685,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "security.ubuntu.com", 
+        "url.hostname": "security.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -747,7 +747,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "security.ubuntu.com", 
+        "url.hostname": "security.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -809,7 +809,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "archive.ubuntu.com", 
+        "url.hostname": "archive.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -871,7 +871,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "archive.ubuntu.com", 
+        "url.hostname": "archive.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -933,7 +933,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "archive.ubuntu.com", 
+        "url.hostname": "archive.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -995,7 +995,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "archive.ubuntu.com", 
+        "url.hostname": "archive.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -1057,7 +1057,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "archive.ubuntu.com", 
+        "url.hostname": "archive.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -1119,7 +1119,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "archive.ubuntu.com", 
+        "url.hostname": "archive.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -1179,7 +1179,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "archive.ubuntu.com", 
+        "url.hostname": "archive.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 
@@ -1239,7 +1239,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "archive.ubuntu.com", 
+        "url.hostname": "archive.ubuntu.com", 
         "user_agent.device": "Other", 
         "user_agent.major": "1", 
         "user_agent.minor": "3", 

diff --git a/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json b/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json
@@ -105,7 +105,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "192.168.86.28", 
+        "url.hostname": "192.168.86.28", 
         "user_agent.device": "Other", 
         "user_agent.major": "67", 
         "user_agent.minor": "0", 
@@ -162,7 +162,7 @@
         "tags": [
             "suricata"
         ], 
-        "url.host.name": "192.168.86.28", 
+        "url.hostname": "192.168.86.28", 
         "user_agent.device": "Other", 
         "user_agent.major": "67", 
         "user_agent.minor": "0",