# Disable 'Host' output field from filebeat

**URL:** https://discuss.elastic.co/t/disable-host-output-field-from-filebeat/151635
**Category:** Beats
**Tags:** filebeat
**Created:** [October 9, 2018, 12:47pm UTC](https://discuss.elastic.co/t/disable-host-output-field-from-filebeat/151635 "2018-10-09T12:47:49Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![meetdave2611997](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@meetdave2611997](https://discuss.elastic.co/u/meetdave2611997)
#### Post date: [October 9, 2018, 12:47pm UTC](https://discuss.elastic.co/t/disable-host-output-field-from-filebeat/151635/1 "2018-10-09T12:47:49Z")

</div>

Hi

First we were using filebeat version 6.2.4 in which filebeat automatically exported 'host' field as string but when we updated filebeat to 6.4.2, newer version started exporting 'host' field as an object and this led us data loss as elasticsearch would not allow an object in string typed field. We create indexes on daily basis so basically, if We upgrade filebeat today then We would lose all data until new mapping gets created on tomorrow's index.

How can we avoid this? We tried dropping fields using drop processor in filebeat but seems It would only drop specific field not the whole object.

Thanks

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 9, 2018, 9:37pm UTC](https://discuss.elastic.co/t/disable-host-output-field-from-filebeat/151635/2 "2018-10-09T21:37:02Z")

</div>

Are you using filebeat with logstash? The host field used to be set in logstash.  
In 6.4, beats introduced the `host` namespace. But logstash used to add a `host` field to events received.

> How can we avoid this?

In beats we normally add the beat version to index names. That is, the default filebeat index is `filebeat-<version>-<date>`. By versioning indices and template mappings we can at least continue to index new data if the mappings would be incompatible.

If you use logstash or ingest node, then you have update the mappings in there.

---

<div class="post-metadata">

### Author: ![meetdave2611997](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@meetdave2611997](https://discuss.elastic.co/u/meetdave2611997)
#### Post date: [October 10, 2018, 2:23pm UTC](https://discuss.elastic.co/t/disable-host-output-field-from-filebeat/151635/3 "2018-10-10T14:23:03Z")

</div>

> Are you using filebeat with logstash? The host field used to be set in logstash.  
> In 6.4, beats introduced the `host` namespace. But logstash used to add a `host` field to events received.

Yes, we are using filebeat with logstash.

We have already created separate indices per teams and due to the older version `host` field is already set up by logstash which is string. Now if we upgrade filebeat then it will start sending out `host` object which would create rejection on elastic side.

Can we disable that `host` object on filebeat side? so even after the upgrade, everything works normally as before. or we just have to put a filter to drop that field on logstash side?

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 12, 2018, 10:36pm UTC](https://discuss.elastic.co/t/disable-host-output-field-from-filebeat/151635/4 "2018-10-12T22:36:45Z")

</div>

You can find more details the about the issue and potential solutions/workarounds in the [Beats - Breaking changes documentation](https://www.elastic.co/guide/en/beats/libbeat/6.4/breaking-changes-6.3.html#breaking-changes-mapping-conflict).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 9, 2018, 10:36pm UTC](https://discuss.elastic.co/t/disable-host-output-field-from-filebeat/151635/5 "2018-11-09T22:36:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.