# Aggregation by host displays hash instead of hostname

**URL:** <https://discuss.elastic.co/t/aggregation-by-host-displays-hash-instead-of-hostname/269158>\
**Category:** Elasticsearch\
**Created:** [April 3, 2021, 4:21pm UTC](https://discuss.elastic.co/t/aggregation-by-host-displays-hash-instead-of-hostname/269158 "2021-04-03T16:21:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![desoul](https://avatars.discourse-cdn.com/v4/letter/d/ac91a4/32.png) [@desoul](https://discuss.elastic.co/u/desoul)\
**Post date:** [April 3, 2021, 4:21pm UTC](https://discuss.elastic.co/t/aggregation-by-host-displays-hash-instead-of-hostname/269158/1 "2021-04-03T16:21:19Z")

</div>

Hello, i try to get unique agent hostnames, grouped with its logfile paths (i have Filebeat agents with system.yml configuration). Here is a query:

```
curl -u myUser:myPassword-X GET "myELKhostname:9237/filebeat*/_search?pretty" -H 'Content- Type: application/json' -d ' {
    "size": 0,
    "aggs": {
      "logSummary": {
        "composite": {
          "sources": [
            { "agentHost": { "terms": { "field": "host.name.keyword" } } },
            { "logPath": { "terms": { "field": "log.file.path.keyword" } } }
          ]
        }
      }
    }
  }
  '

```

Here a output:

```
{
  "took" : 1142,
  "timed_out" : false,
  "_shards" : {
    "total" : 2,
    "successful" : 2,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : null,
    "hits" : []
  },
  "aggregations" : {
    "logSummary" : {
      "after_key" : {
        "agentHost" : "2250827ea151",
        "logPath" : "/var/log/dpkg.log"
      },
      "buckets" : [
        {
          "key" : {
            "agentHost" : "084c64f1ad0e",
            "logPath" : "/var/log/alternatives.log"
          },
          "doc_count" : 97
        },
        {
          "key" : {
            "agentHost" : "084c64f1ad0e",
            "logPath" : "/var/log/bootstrap.log"
          },
          "doc_count" : 1322
        },
        {
          "key" : {
            "agentHost" : "084c64f1ad0e",
            "logPath" : "/var/log/cloud-init-output.log"
          },
          "doc_count" : 105
        },
        {
          "key" : {
            "agentHost" : "084c64f1ad0e",
            "logPath" : "/var/log/cloud-init.log"
          },
          "doc_count" : 553
        },
        {
          "key" : {
            "agentHost" : "084c64f1ad0e",
            "logPath" : "/var/log/dpkg.log"
          },
          "doc_count" : 5057
        },
        {
          "key" : {
            "agentHost" : "2250827ea151",
            "logPath" : "/var/log/alternatives.log"
          },
          "doc_count" : 104
        },
        {
          "key" : {
            "agentHost" : "2250827ea151",
            "logPath" : "/var/log/bootstrap.log"
          },
          "doc_count" : 1293
        },
        {
          "key" : {
            "agentHost" : "2250827ea151",
            "logPath" : "/var/log/cloud-init-output.log"
          },
          "doc_count" : 103
        },
        {
          "key" : {
            "agentHost" : "2250827ea151",
            "logPath" : "/var/log/cloud-init.log"
          },
          "doc_count" : 553
        },
        {
          "key" : {
            "agentHost" : "2250827ea151",
            "logPath" : "/var/log/dpkg.log"
          },
          "doc_count" : 5667
        }
      ]
    }
  }
}

```

As you can see, the agentHost aggregation property have a hash, not hostname. Why?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2021, 4:22pm UTC](https://discuss.elastic.co/t/aggregation-by-host-displays-hash-instead-of-hostname/269158/2 "2021-05-01T16:22:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.