Copying field values

[macg (Robbie MacGregor)]

I feel like I'm basically trying to do exactly what @madduck proposed here:

Hosts duplicated with and without fqdn

Hi Christian, glad you found something that works for you. To tie into your earlier question about doing it with winlogbeat processors thats also possible. processors: - drop_fields: fields: [ "host.name" ] - copy_fields: fields: - from: host.hostname to: host.name You will have to drop the field first because the copy_fields function cant write into already existing fields.

That gives me some hope I'm not totally out to lunch, but I'm having a heck of a time getting my hooks into the field I'm after.