...
Discussion: roll all 3 fqdn, hostname or ip into one field - do we ever need two of the 3 fields concurrently?
Dave Williamson We seem to cover well what to put in this field in bare metal and virtualized environments, but I think we have not managed to come to closure as to what we should put in containerized environments. I would suggest that in all environments we simply ask that whatever "hostname" reports be logged in this field.
- TODO: Verify what is also available from a filebeat agent when it exists
...