[elastic_agent]: Agent metrics dashboard: "Agent Hostname" filter not working on 8.15

[AndersonQ]

Integration Name

Elastic Agent [elastic_agent]

Dataset Name

No response

Integration Version

2.7.6

Agent Version

8.15.5

Agent Output Type

elasticsearch

Elasticsearch Version

8.15.5

OS Version and Architecture

N/A

Software/API Version

No response

Error Message

The "Agent Hostname" filter on the "Agent metrics" dashboard does not work.

Event Original

No response

What did you do?

Opened the [Elastic Agent] Agent metrics dashboard and selected an agent hostname.

What did you see?

No changes on the data, is kept showing data for all the agents, including components not running on the agent I selected.

I checked the filter with a 9.3 stack and it's exactly the same

What did you expect to see?

The data correctly filtered, as the dashboard is built to work only with a single agent

Anything else?

Upgrading the stack to 8.19.14, the latest 8.19, fixed the issue. As the integration is meant to work with 8.15, either it should be fixed or the stack min version updated.

[elasticmachine]

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

[github-actions]

Possible duplicates:

• [elastic_agent]: agent.name and component.id cannot be used for filtering #16567 — it describes the same Agent metrics dashboard filtering failure (agent.name / component.id cannot be used for filtering), includes reproduction on 8.15.5, and reports version-dependent behavior that aligns with this issue.

Note

🔒 Integrity filter blocked 50 items

The following items were blocked because they don't meet the GitHub integrity level.

• #17215 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #11951 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #11056 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #6294 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #5305 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #4667 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #8565 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #8808 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #6598 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #5854 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18504 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #16982 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17440 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #9319 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #812 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #15036 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 34 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Duplicate Issue Detector

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

tl;dr: The strongest evidence points to a Kibana controls compatibility gap on 8.15 for this dashboard’s optionsListControl state (not a missing mapping), so I recommend making the Agent Hostname control schema 8.15-safe; if that cannot be made reliable, raise the package minimum Kibana version above 8.15.

Recommendation
Update packages/elastic_agent/kibana/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395.json to use the simpler options-list control shape already used by other dashboards in this package (remove nullable advanced keys and keep fieldName: "agent.name"), then validate on 8.15.5 and 8.19.x. Keep the package at ^8.15.0 only if that works consistently; otherwise bump min Kibana to the first confirmed-good version.

Findings

1. The affected dashboard is the current [Elastic Agent] Agent metrics saved object:

   • packages/elastic_agent/kibana/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395.json:9348

2. The “Agent Hostname” control uses agent.name and a newer/expanded control state:

   • ...f47f18cc...json:18 → "fieldName": "agent.name"
   • ...f47f18cc...json:20-22,25-26,41 → hideExclude/hideExists/hideSort/runPastTimeout: null, searchTechnique: "prefix", showApplySelections: false

3. Those nullable advanced keys are unique in this package’s dashboards:

   • packages/elastic_agent/kibana/dashboard/elastic_agent-f47f18cc-...json:20-22,25,41 (only matches in packages/elastic_agent/kibana/dashboard/*.json)

4. Mapping evidence does not support a missing-field root cause:

   • agent.name is defined as ECS external in metrics stream fields: packages/elastic_agent/data_stream/elastic_agent_metrics/fields/ecs.yml:7-8
   • package still declares support for 8.15: packages/elastic_agent/manifest.yml:10 (^8.15.0 || ^9.0.0)

5. Related prior fix was mapping-focused (different symptom class):

   • packages/elastic_agent/changelog.yml:43-45 references PR [elastic_agent]: single system.process.cpu.* and component.* mapping #17016 (component.* / system.process.* standardization).

Verification

I ran local checks to verify field usage, control state, and package constraints.

$ grep -RIn "agent\.hostname" packages/elastic_agent
# (no matches)

$ grep -nE "Agent Hostname|fieldName|searchTechnique|showApplySelections|hideExclude|runPastTimeout" \
  packages/elastic_agent/kibana/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395.json
18:                        "fieldName": "agent.name",
20:                        "hideExclude": null,
25:                        "runPastTimeout": null,
26:                        "searchTechnique": "prefix",
33:                        "title": "Agent Hostname"
41:            "showApplySelections": false

$ grep -nE "^version: 2\.7\.6|\^8\.15\.0" packages/elastic_agent/manifest.yml
3:version: 2.7.6
10:    version: "^8.15.0 || ^9.0.0"

Detailed Action Plan

1. In packages/elastic_agent/kibana/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395.json, normalize the Agent Hostname control (explicitInput) to the same minimal shape used in other package dashboards (for example patterns in elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824.json:14-22,29-37).
2. Keep fieldName: "agent.name" and singleSelect behavior; remove nullable advanced keys (hideExclude, hideExists, hideSort, runPastTimeout) and any control config not required for 8.15 compatibility.
3. Rebuild/export dashboard asset using the package’s normal workflow so saved object format is consistent.
4. Validate behavior on stack 8.15.5 and 8.19.x:
   • select Agent Hostname value, confirm global filter is applied and panels scope to selected agent.
5. Decision gate:
   • if 8.15 is now reliable, keep current manifest constraint;
   • if still not reliable due Kibana limitation, bump packages/elastic_agent/manifest.yml minimum Kibana version to the first verified-good version and add changelog entry explaining why.

Related Items

Type	Link	Relevance
Issue	#18523	Current bug report
Issue	#16567	Prior filtering-related investigation (closed)
PR	#17016	Mapping standardization fix for earlier field/mapping symptoms
File	packages/elastic_agent/kibana/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395.json	Current Agent metrics dashboard + control config
File	packages/elastic_agent/manifest.yml	Declared Kibana compatibility (^8.15.0)
File	packages/elastic_agent/data_stream/elastic_agent_metrics/fields/ecs.yml	Confirms agent.name mapping exists

Note

🔒 Integrity filter blocked 20 items

The following items were blocked because they don't meet the GitHub integrity level.

• #17214 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #11907 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #4478 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #8238 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #534 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #10383 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #7533 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #8886 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #3734 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #7364 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #7621 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #2602 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #3210 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #2160 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #8314 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17015 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 4 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.