Pass namespace to FQDN ES query

testing/integration/fqdn_test.go

@@ -6,6 +6,7 @@
 package integration
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -98,8 +99,8 @@ func TestFQDN(t *testing.T) {
 	agent := verifyAgentName(t, shortName, info.KibanaClient)
 
 	t.Log("Verify that hostname in `logs-*` and `metrics-*` is short hostname")
-	verifyHostNameInIndices(t, "logs-*", shortName, info.ESClient)
-	verifyHostNameInIndices(t, "metrics-*", shortName, info.ESClient)
+	verifyHostNameInIndices(t, "logs-*", shortName, info.Namespace, info.ESClient)
+	verifyHostNameInIndices(t, "metrics-*", shortName, info.Namespace, info.ESClient)
 
 	t.Log("Update Agent policy to enable FQDN")
 	policy.AgentFeatures = []map[string]interface{}{
@@ -129,8 +130,8 @@ func TestFQDN(t *testing.T) {
 	verifyAgentName(t, fqdn, info.KibanaClient)
 
 	t.Log("Verify that hostname in `logs-*` and `metrics-*` is FQDN")
-	verifyHostNameInIndices(t, "logs-*", fqdn, info.ESClient)
-	verifyHostNameInIndices(t, "metrics-*", fqdn, info.ESClient)
+	verifyHostNameInIndices(t, "logs-*", fqdn, info.Namespace, info.ESClient)
+	verifyHostNameInIndices(t, "metrics-*", fqdn, info.Namespace, info.ESClient)
 
 	t.Log("Update Agent policy to disable FQDN")
 	policy.AgentFeatures = []map[string]interface{}{
@@ -185,7 +186,34 @@ func verifyAgentName(t *testing.T, hostname string, kibClient *kibana.Client) *k
 	return agent
 }
 
-func verifyHostNameInIndices(t *testing.T, indices, hostname string, esClient *elasticsearch.Client) {
+func verifyHostNameInIndices(t *testing.T, indices, hostname, namespace string, esClient *elasticsearch.Client) {
+	queryRaw := map[string]interface{}{
+		"query": map[string]interface{}{
+			"bool": map[string]interface{}{
+				"must": []map[string]interface{}{
+					{
+						"term": map[string]interface{}{
+							"host.name": map[string]interface{}{
+								"value": hostname,
+							},
+						},
+					},
+					{
+						"term": map[string]interface{}{
+							"data_stream.namespace": map[string]interface{}{
+								"value": namespace,
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	var buf bytes.Buffer
+	err := json.NewEncoder(&buf).Encode(queryRaw)
+	require.NoError(t, err)
+
 	search := esClient.Search
 
 	require.Eventually(
@@ -196,6 +224,7 @@ func verifyHostNameInIndices(t *testing.T, indices, hostname string, esClient *e
 				search.WithSort("@timestamp:desc"),
 				search.WithFilterPath("hits.hits"),
 				search.WithSize(1),
+				search.WithBody(&buf),
 			)
 			require.NoError(t, err)
 			require.False(t, resp.IsError())
@@ -216,9 +245,7 @@ func verifyHostNameInIndices(t *testing.T, indices, hostname string, esClient *e
 			err = decoder.Decode(&body)
 			require.NoError(t, err)
 
-			require.Len(t, body.Hits.Hits, 1)
-			hit := body.Hits.Hits[0]
-			return hostname == hit.Source.Host.Name
+			return len(body.Hits.Hits) == 1
 		},
 		2*time.Minute,
 		5*time.Second,