In cases where an agent is not running on a host generating an event (e.g. APM server), it's useful to track where the agent is running without touching host.hostname.

Beats has already replaced beat.hostname with agent.hostname here elastic/beats#8873.

So the relationship between the two fields is:

• host.hostname should be populated with the hostname of the node generating the event
• agent.hostname should be populated with the hostname of the node where the agent is running, if different than the source of the event.
  • Question: should we always populate it, even if it's the exact same value?