# Can I change the primary key for identifying hosts in the SIEM app?

**URL:** <https://discuss.elastic.co/t/can-i-change-the-primary-key-for-identifying-hosts-in-the-siem-app/242372>\
**Category:** SIEM\
**Created:** [July 23, 2020, 4:32pm UTC](https://discuss.elastic.co/t/can-i-change-the-primary-key-for-identifying-hosts-in-the-siem-app/242372 "2020-07-23T16:32:38Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![macg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/macg/32/72712_2.png) [@macg](https://discuss.elastic.co/u/macg)\
**Post date:** [August 4, 2020, 12:12pm UTC](https://discuss.elastic.co/t/can-i-change-the-primary-key-for-identifying-hosts-in-the-siem-app/242372/4 "2020-08-04T12:12:51Z")

</div>

Sorry for the slow response. I was without reliable access for a couple of days. I'm interested in the approach of declaring a new ingest pipeline, but could use a little direction in that regard. I've been working on dropping/copying/renaming fields as a parallel solution without much luck. I cannot access `host.hostname` from my processors for some reason.

> [@Copying field values](https://discuss.elastic.co/t/copying-field-values/242520/7):
>
> Sorry for the slow response. I was away from work for a couple of days without reliable access. Adding the add\_host\_metadata processor brings a lot of additional information about the device shipping data into my documents/JSON, but does not make the host.hostname field available to rename. Processors now appear to read host.hostname as containing the value in the host.name field, which is not the case when I look at the JSON. The behaviour of this processor is very unexpected: processors: …

---

_[View the full topic](https://discuss.elastic.co/t/can-i-change-the-primary-key-for-identifying-hosts-in-the-siem-app/242372)._