From 22a61ff737b8bb477bf9296dfe1ff0ed049a63ca Mon Sep 17 00:00:00 2001
From: Eric Beahan <eric.beahan@elastic.co>
Date: Wed, 26 Aug 2020 16:42:42 -0500
Subject: [PATCH 1/5] adding host identifiers RFC

---
 rfcs/text/0000-host-identifiers.md | 60 ++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 rfcs/text/0000-host-identifiers.md

diff --git a/rfcs/text/0000-host-identifiers.md b/rfcs/text/0000-host-identifiers.md
new file mode 100644
index 0000000000..21814b0224
--- /dev/null
+++ b/rfcs/text/0000-host-identifiers.md
@@ -0,0 +1,60 @@
+# 0000: Host Identifiers
+<!-- Leave this ID at 0000. The ECS team will assign a unique, contiguous RFC number upon merging the initial stage of this RFC. -->
+
+- Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
+- Date: **TBD** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->
+
+<!--
+As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.
+Feel free to remove these comments as you go along.
+-->
+
+<!--
+Stage 0: Provide a high level summary of the premise of these changes. Briefly describe the nature, purpose, and impact of the changes. ~2-5 sentences.
+-->
+
+Many sources populating event `host.*` fields have different behaviors in how the host values are set. This can cause confusion, complexity, and frustration for users expecting to easily identify unique hosts in their environments. This RFC proposes establishing a common convention to ensure more consistent mapping of these host identifier fields.
+
+At the time of writing, the following are several known challenges caused by these inconsistencies:
+
+* Confusion between the `host.name` and `host.hostname` fields
+* Unicity problems in raw hostnames
+* Unicity problems in host.ids (e.g. misconfigured config management tools, machine images, disk snapshots, etc.)
+* Usage of unqualified vs. fully-qualified hostnames
+
+## People
+
+The following are the people that consulted on the contents of this RFC.
+
+* @ebeahan | author
+
+<!--
+Who will be or has consulted on the contents of this RFC? Identify authorship and sponsorship, and optionally identify the nature of involvement of others. Link to GitHub aliases where possible. This list will likely change or grow stage after stage.
+
+e.g.:
+
+* @Yasmina | author
+* @Monique | sponsor
+* @EunJung | subject matter expert
+* @JaneDoe | grammar, spelling, prose
+* @Mariana
+-->
+
+
+## References
+
+<!-- Insert any links appropriate to this RFC in this section. -->
+* https://github.com/elastic/beats/issues/1070#issuecomment-677782937
+* https://github.com/elastic/kibana/pull/74272
+* https://github.com/elastic/beats/issues/18043#issuecomment-623501936
+
+### RFC Pull Requests
+
+<!-- An RFC should link to the PRs for each of it stage advancements. -->
+
+* Stage 0: https://github.com/elastic/ecs/pull/NNN
+
+<!--
+* Stage 1: https://github.com/elastic/ecs/pull/NNN
+...
+-->

From 06fe2ada94d9de93ea37ef403defdc316cba7593 Mon Sep 17 00:00:00 2001
From: Eric Beahan <eric.beahan@elastic.co>
Date: Wed, 26 Aug 2020 16:53:44 -0500
Subject: [PATCH 2/5] adding stage 0 PR link

---
 rfcs/text/0000-host-identifiers.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rfcs/text/0000-host-identifiers.md b/rfcs/text/0000-host-identifiers.md
index 21814b0224..79c525e99a 100644
--- a/rfcs/text/0000-host-identifiers.md
+++ b/rfcs/text/0000-host-identifiers.md
@@ -52,7 +52,7 @@ e.g.:
 
 <!-- An RFC should link to the PRs for each of it stage advancements. -->
 
-* Stage 0: https://github.com/elastic/ecs/pull/NNN
+* Stage 0: https://github.com/elastic/ecs/pull/955
 
 <!--
 * Stage 1: https://github.com/elastic/ecs/pull/NNN

From f2f9e221c6c55d4c4abea11c1061c5c33ffa909b Mon Sep 17 00:00:00 2001
From: Eric Beahan <ebeahan@gmail.com>
Date: Thu, 27 Aug 2020 12:32:14 -0500
Subject: [PATCH 3/5] Apply suggestions from code review

Co-authored-by: Mathieu Martin <webmat@gmail.com>
---
 rfcs/text/0000-host-identifiers.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rfcs/text/0000-host-identifiers.md b/rfcs/text/0000-host-identifiers.md
index 79c525e99a..5643120ac0 100644
--- a/rfcs/text/0000-host-identifiers.md
+++ b/rfcs/text/0000-host-identifiers.md
@@ -18,9 +18,9 @@ Many sources populating event `host.*` fields have different behaviors in how th
 At the time of writing, the following are several known challenges caused by these inconsistencies:
 
 * Confusion between the `host.name` and `host.hostname` fields
-* Unicity problems in raw hostnames
+* Unicity problems in raw hostnames. This can be common with workstations on certain OSes, for example a fleet of "MacBook-Pro.local"
 * Unicity problems in host.ids (e.g. misconfigured config management tools, machine images, disk snapshots, etc.)
-* Usage of unqualified vs. fully-qualified hostnames
+* Usage of unqualified vs. fully-qualified hostnames in the same fields (by different data sources) leads to host duplication
 
 ## People
 

From 5656d10666cd890faa8df4630bef469749182bfb Mon Sep 17 00:00:00 2001
From: Eric Beahan <eric.beahan@elastic.co>
Date: Tue, 8 Sep 2020 11:08:25 -0500
Subject: [PATCH 4/5] assigning rfc number and date

---
 .../{0000-host-identifiers.md => 0006-host-identifiers.md}    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename rfcs/text/{0000-host-identifiers.md => 0006-host-identifiers.md} (94%)

diff --git a/rfcs/text/0000-host-identifiers.md b/rfcs/text/0006-host-identifiers.md
similarity index 94%
rename from rfcs/text/0000-host-identifiers.md
rename to rfcs/text/0006-host-identifiers.md
index 5643120ac0..3a5effe383 100644
--- a/rfcs/text/0000-host-identifiers.md
+++ b/rfcs/text/0006-host-identifiers.md
@@ -1,8 +1,8 @@
-# 0000: Host Identifiers
+# 0006: Host Identifiers
 <!-- Leave this ID at 0000. The ECS team will assign a unique, contiguous RFC number upon merging the initial stage of this RFC. -->
 
 - Stage: **0 (strawperson)** <!-- Update to reflect target stage. See https://elastic.github.io/ecs/stages.html -->
-- Date: **TBD** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->
+- Date: **2020-09-08** <!-- The ECS team sets this date at merge time. This is the date of the latest stage advancement. -->
 
 <!--
 As you work on your RFC, use the "Stage N" comments to guide you in what you should focus on, for the stage you're targeting.

From 8817acf59862f6ec0bd7cf32dc908928f39cd6e3 Mon Sep 17 00:00:00 2001
From: Eric Beahan <eric.beahan@elastic.co>
Date: Tue, 8 Sep 2020 11:21:08 -0500
Subject: [PATCH 5/5] adding co-author

---
 rfcs/text/0006-host-identifiers.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rfcs/text/0006-host-identifiers.md b/rfcs/text/0006-host-identifiers.md
index 3a5effe383..21b2f72261 100644
--- a/rfcs/text/0006-host-identifiers.md
+++ b/rfcs/text/0006-host-identifiers.md
@@ -27,6 +27,7 @@ At the time of writing, the following are several known challenges caused by the
 The following are the people that consulted on the contents of this RFC.
 
 * @ebeahan | author
+* @webmat | co-author
 
 <!--
 Who will be or has consulted on the contents of this RFC? Identify authorship and sponsorship, and optionally identify the nature of involvement of others. Link to GitHub aliases where possible. This list will likely change or grow stage after stage.