Data on target machine is stored in a ndjson logfile and is read by filebeat/elastic-agent then transferred to fleet server agent but the host.id in the Elasticsearch index is no longer the original value stored in the ndjson source file. I have modified \agent\stream\stream.yml.hbs processors with copy_fields to test.id but it returns the same guid not the original source data. I need the host.id data to remain intact. How do I correct this issue?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.