[Infra Monitoring UI] Inventory page shows Kubernetes Pods as hosts

[miltonhultgren]

If you have a Ruby app instrumented with the Elastic Ruby APM agent running inside Kubernetes, it creates documents that have the pod name under host.name so when the Inventory view groups by host.name to display Hosts it'll also end up displaying the Ruby Pod as a host.

The fix should really happen in the Ruby agent (for consistency across agents) but perhaps we should filter the Inventory by Metricbeat module or add some kind of "field exists" check, or use host.hostname instead.

[elasticmachine]

Pinging @elastic/infra-monitoring-ui (Team:Infra Monitoring UI)

[miltonhultgren]

@MiriamAparicio Do you know if there is an issue on the APM (Ruby) Agent side to change this behavior? Since that would be the real fix.

[jasonrhodes]

Does this only happen with the Ruby agent or is it a limitation of any app running inside K8S?

[miltonhultgren]

As far as I know it only happens for the Ruby agent (since that's the only one we see in Edge, while we do get data from other agents too).

I don't know if this is also impacted by elastic/apm-server#8118 in some way.

[kuisathaverat]

It happens in the PHP agent too

[smith]

This also happens with the PHP agent, as it doesn't send any Kubernetes metadata. See elastic/apm-agent-php#64

[smith]

Ruby agent issue is tracked here: elastic/apm-agent-ruby#1292

[miltonhultgren]

I wonder if there is any sure way to avoid this beyond adding dataset filters to the Inventory view (and any other view that assumes host.name === "a host")? @jasonrhodes That asset document sure would come in handy here :D

[jasonrhodes]

Heh, yes! In my opinion, the inventory UI is doing the "right thing" here and displaying host names as host names. If collectors are putting a value in the host name field that is not actually a host name, that seems like the bug that should be fixed (as is being done in APM server, I believe).

[smith]

Closing this. The Ruby agent issue is resolved. elastic/apm-agent-php#64 is still open so that should be fixed by the agent team.