Beats always sets the field host.name: https://github.com/elastic/beats/blob/master/libbeat/publisher/pipeline/module.go#L88 The reason this was introduce was to have always host data available as an object. Also the add_host_metadata processor is enabled in the default config. This make sense as long as the Beats collect data locally. But in cases like heartbeat, apm-server where the event is initiated on a different machine, having the host.name of the local machine does not make too much sense. Also if metricbeat fetches metrics from a remote host, the host.* data should be populate with the info from this host and not the host metricbeat is running on.

In the above cases, instead of being the agent, the role of the Beats is the observer: https://github.com/elastic/ecs#-observer-fields

To allow more flexibility, libbeat should stop populating host.name always. In addition a beat / event should be configurable if it's an agent on an observer. For the host metadata processor, it could be decided based on the role if the host metadata should be enriched or not.

Metricbeat or Filebeat can have different roles based on the input. If Filebeat reads data from a file, it's the agent, if it opens a syslog input, it becomes an observer.