# Can I change the primary key for identifying hosts in the SIEM app?

**URL:** <https://discuss.elastic.co/t/can-i-change-the-primary-key-for-identifying-hosts-in-the-siem-app/242372>\
**Category:** SIEM\
**Created:** [July 23, 2020, 4:32pm UTC](https://discuss.elastic.co/t/can-i-change-the-primary-key-for-identifying-hosts-in-the-siem-app/242372 "2020-07-23T16:32:38Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [July 27, 2020, 10:27pm UTC](https://discuss.elastic.co/t/can-i-change-the-primary-key-for-identifying-hosts-in-the-siem-app/242372/3 "2020-07-27T22:27:05Z")

</div>

I haven't done this before as I particularly enjoy using `host.name` but this might be helpful as it looks like someone else has done this before:

> [@Hosts duplicated with and without fqdn](https://discuss.elastic.co/t/hosts-duplicated-with-and-without-fqdn/238546/7):
>
> Hi Christian, glad you found something that works for you. To tie into your earlier question about doing it with winlogbeat processors thats also possible. processors: - drop\_fields: fields: ["host.name"] - copy\_fields: fields: - from: host.hostname to: host.name You will have to drop the field first because the copy\_fields function cant write into already existing fields.

---

_[View the full topic](https://discuss.elastic.co/t/can-i-change-the-primary-key-for-identifying-hosts-in-the-siem-app/242372)._