Elasearch filed take the empty values

there is a option host,some logstash agent get the empty values,only one get the real values,I define an index template to slove the not_analyzed,
what metod does the "host" use ? read the logstash agent hostname or some config?

Your post is a little hard to understand, which is ok! :slight_smile:

Are you asking where the host value comes from? If you are ingesting data with Logstash, then it comes from the hostname that is running the Logstash process.

i have four logstash agent(same config files),one of them can pass the host value,others is empty,

Ok, let me move this to the Logstash category, hopefully someone else can help out too.