Can I change the primary key for identifying hosts in the SIEM app?

[Frank_Hassanabad]

I haven't done this before as I particularly enjoy using host.name but this might be helpful as it looks like someone else has done this before:

Hosts duplicated with and without fqdn

Hi Christian, glad you found something that works for you. To tie into your earlier question about doing it with winlogbeat processors thats also possible. processors: - drop_fields: fields: [ "host.name" ] - copy_fields: fields: - from: host.hostname to: host.name You will have to drop the field first because the copy_fields function cant write into already existing fields.