Can I change the primary key for identifying hosts in the SIEM app?

[macg (Robbie MacGregor)]

Sorry for the slow response. I was without reliable access for a couple of days. I'm interested in the approach of declaring a new ingest pipeline, but could use a little direction in that regard. I've been working on dropping/copying/renaming fields as a parallel solution without much luck. I cannot access host.hostname from my processors for some reason.

Copying field values

Sorry for the slow response. I was away from work for a couple of days without reliable access. Adding the add_host_metadata processor brings a lot of additional information about the device shipping data into my documents/JSON, but does not make the host.hostname field available to rename. Processors now appear to read host.hostname as containing the value in the host.name field, which is not the case when I look at the JSON. The behaviour of this processor is very unexpected: processors: …