Apply review suggestion elastic#2

docs/field-details.asciidoc

@@ -3030,11 +3030,11 @@ example: `elasticsearch-metrics`
 
 This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.
 
-In the case of Elasticsearch, the `service.node.name` could contain the node name, e.g. "ingest" or "master". In APM, this field is used to distinguish between nodes of the same traced service and can be manually configured through the APM agents.
+In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.
 
 type: keyword
 
-example: `master`
+example: `instance-0000000016`
 
 | extended
 

generated/beats/fields.ecs.yml

@@ -2300,11 +2300,13 @@
         be differentiated. Therefore, `service.node.name` should typically be unique
         across nodes of a given service.
 
-        In the case of Elasticsearch, the `service.node.name` could contain the node
-        name, e.g. "ingest" or "master". In APM, this field is used to distinguish
-        between nodes of the same traced service and can be manually configured through
-        the APM agents.'
-      example: master
+        In the case of Elasticsearch, the `service.node.name` could contain the unique
+        node name within the Elasticsearch cluster. In cases where the service doesn''t
+        have the concept of a node name, the host name or container name can be used
+        to distinguish running instances that make up this service. If those do not
+        provide uniqueness (e.g. multiple instances of the service running on the
+        same host) - the node name can be manually set.'
+      example: instance-0000000016
     - name: state
       level: core
       type: keyword

generated/csv/fields.csv

@@ -291,7 +291,7 @@ server.user.name,keyword,core,albert,1.2.0-dev
 service.ephemeral_id,keyword,extended,8a4f500f,1.2.0-dev
 service.id,keyword,core,d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6,1.2.0-dev
 service.name,keyword,core,elasticsearch-metrics,1.2.0-dev
-service.node.name,keyword,extended,master,1.2.0-dev
+service.node.name,keyword,extended,instance-0000000016,1.2.0-dev
 service.state,keyword,core,,1.2.0-dev
 service.type,keyword,core,elasticsearch,1.2.0-dev
 service.version,keyword,core,3.2.4,1.2.0-dev

generated/ecs/ecs_flat.yml

@@ -3279,10 +3279,13 @@ service.node.name:
     Therefore, `service.node.name` should typically be unique across nodes of a given
     service.
 
-    In the case of Elasticsearch, the `service.node.name` could contain the node name,
-    e.g. "ingest" or "master". In APM, this field is used to distinguish between nodes
-    of the same traced service and can be manually configured through the APM agents.'
-  example: master
+    In the case of Elasticsearch, the `service.node.name` could contain the unique
+    node name within the Elasticsearch cluster. In cases where the service doesn''t
+    have the concept of a node name, the host name or container name can be used to
+    distinguish running instances that make up this service. If those do not provide
+    uniqueness (e.g. multiple instances of the service running on the same host) -
+    the node name can be manually set.'
+  example: instance-0000000016
   flat_name: service.node.name
   ignore_above: 1024
   level: extended

generated/ecs/ecs_nested.yml

@@ -3708,11 +3708,13 @@ service:
         be differentiated. Therefore, `service.node.name` should typically be unique
         across nodes of a given service.
 
-        In the case of Elasticsearch, the `service.node.name` could contain the node
-        name, e.g. "ingest" or "master". In APM, this field is used to distinguish
-        between nodes of the same traced service and can be manually configured through
-        the APM agents.'
-      example: master
+        In the case of Elasticsearch, the `service.node.name` could contain the unique
+        node name within the Elasticsearch cluster. In cases where the service doesn''t
+        have the concept of a node name, the host name or container name can be used
+        to distinguish running instances that make up this service. If those do not
+        provide uniqueness (e.g. multiple instances of the service running on the
+        same host) - the node name can be manually set.'
+      example: instance-0000000016
       flat_name: service.node.name
       ignore_above: 1024
       level: extended

schema.json

@@ -2168,8 +2168,8 @@
         "type": "keyword"
       }, 
       "service.node.name": {
-        "description": "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the node name, e.g. \"ingest\" or \"master\". In APM, this field is used to distinguish between nodes of the same traced service and can be manually configured through the APM agents.", 
-        "example": "master", 
+        "description": "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", 
+        "example": "instance-0000000016", 
         "footnote": "", 
         "group": 2, 
         "level": "extended", 

schemas/service.yml

@@ -47,7 +47,7 @@
     - name: node.name
       level: extended
       type: keyword
-      example: "master"
+      example: "instance-0000000016"
       short: Name of the service node.
       description: >
         Name of a service node.
@@ -57,9 +57,13 @@
         typically be unique across nodes of a given service.
 
         In the case of Elasticsearch, the `service.node.name` could contain
-        the node name, e.g. "ingest" or "master".
-        In APM, this field is used to distinguish between nodes of the same
-        traced service and can be manually configured through the APM agents.
+        the unique node name within the Elasticsearch cluster.
+        In cases where the service doesn't have the concept of a node name,
+        the host name or container name can be used to distinguish running
+        instances that make up this service. If those do not provide uniqueness
+        (e.g. multiple instances of the service running on the same host) - the
+        node name can be manually set.
+
 
     - name: type
       level: core