Sorry for the slow response. I was away from work for a couple of days without reliable access.
Adding the add_host_metadata processor brings a lot of additional information about the device shipping data into my documents/JSON, but does not make the host.hostname field available to rename.
Processors now appear to read host.hostname as containing the value in the host.name field, which is not the case when I look at the JSON.
The behaviour of this processor is very unexpected:
processors:
- add_host_metadata: ~
- rename:
fields:
- from: host.hostname
to: new_name
fail_on_error: false
ignore_missing: true
A new_name field will be created, containing the value of host.name, and both host.hostname and host.name will remain as document fields... which is to say, no rename operation takes place at all. I'm fairly stumped.