# Detector field "beat.hostname" is not an aggregatable field **URL:** \ **Category:** SIEM\ **Created:** [October 20, 2021, 3:04pm UTC](https://discuss.elastic.co/t/detector-field-beat-hostname-is-not-an-aggregatable-field/287212 "2021-10-20T15:04:43Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Mark3](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Mark3](https://discuss.elastic.co/u/Mark3)\ **Post date:** [October 20, 2021, 3:04pm UTC](https://discuss.elastic.co/t/detector-field-beat-hostname-is-not-an-aggregatable-field/287212/1 "2021-10-20T15:04:43Z")
Following the instructions for the DETECT DNS DATA EXFILTRATION lab, I hit this wall, any ideas? Cheers, Mark ---
**Author:** ![Mike\_Paquette](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_paquette/32/119011_2.png) [@Mike\_Paquette](https://discuss.elastic.co/u/Mike_Paquette)\ **Post date:** [October 26, 2021, 11:00am UTC](https://discuss.elastic.co/t/detector-field-beat-hostname-is-not-an-aggregatable-field/287212/2 "2021-10-26T11:00:47Z")
Hi @Mark3, Thanks for trying out our machine learning anomaly detection jobs for DNS. Please try using field `host.name` instead of `beat.hostname`. `beat.hostname` was used prior to the introduction of [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html), and may no longer be available in your packetbeat data. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 23, 2021, 11:01am UTC](https://discuss.elastic.co/t/detector-field-beat-hostname-is-not-an-aggregatable-field/287212/3 "2021-11-23T11:01:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.