[Fleet]: event.datasets field is blank with logs under Logs tab.

[amolnater-qasource]

Kibana version: 7.15.0 Snapshot Kibana cloud environment

Host OS and Browser version: All, All

Build details:

Build: 43322
Commit: f448fcd00b319a3be0d1a1ae356956446e4d7ef8
Artifact Link: https://snapshots.elastic.co/7.15.0-af472020/downloads/beats/elastic-agent/elastic-agent-7.15.0-SNAPSHOT-linux-x86_64.tar.gz

Preconditions:

1. 7.15.0 Snapshot Kibana cloud environment should be available.
2. An agent must be installed with Default policy having System integration.

Steps to reproduce:

1. Login to Kibana environment.
2. Navigate to Agents>Logs tab.
3. Observe blank event.datasets with logs in the Logs field.

Expected Result:
event.datasets field should not be blank with logs under Logs tab. The dataset selected from Datasets dropdown should be visible under event.datasets field.

Note:

• Datasets filter showing correct data as per selected filter under Logs tab, however just not event.datasets field is blank.

Screenshot:

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[amolnater-qasource]

@manishgupta-qasource Please review.

[manishgupta-qasource]

Reviewed & Assigned to @jen-huang

CC: @EricDavisX

[jen-huang]

Looks like this is happening because multiple values are being written to event.dataset field and the UI handles strings only, not arrays of strings. As you can see in the screenshot this happened when I tested a 7.14 agent too:

This looks like something the agent team should look at and confirm if these kind of values are expected (metricbeat-json.log doesn't seem right for this field IMO).

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[EricDavisX]

if this is coming from a 7.14 Agent, I'd ask for further review to see how impactful this may be. we might fix it more urgently if it is impactful.

[michel-laterman]

I'll take a look, the issue is present on 7.14.0

looking into the actual log entries, event.dataset appears as two keys in the document.

    "event": {
      "dataset": "elastic_agent.metricbeat"
    },

Once with the expected value

    "event.dataset": [
      "elastic_agent.metricbeat",
      "metricbeat-json.log"
    ]

and at the end with an array