I'm very confused about how host.name, agent.hostname, observer.hostname etc. are supposed to work.

I have a fairly simple setup where my apps live in containers, Filebeat lives in a different container, and all the apps send JSON-formatted logs to Filebeat over UDP. I have no idea what value should be in host.name.

The ECS states:

ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken.

So that's pretty clearly the application's host. The APM dashboard seems to agree; when I click "Show host logs", it gives me logs filtered on host.name, with the application's hostname prefilled.

But Filebeat disagrees. I've tried letting it do its own thing, and I've tried setting host.name in the application logs; in both cases, it overwrites host.name with its own hostname, so of course the log dashboard is empty, since all the traces have the application's hostname.

I've come across a bunch of issues related to host.name but I have not been able to understand which behavior is considered a bug, the APM dashboard's or Filebeat's:

#13706
#13589
#12983
#12107
#10698