I added a hostname field to my index using Logstash Grok:
grok {
match => { "originsicname" => "CN=%{HOSTNAME:hostname}," }
...
For some reason I cannot use this hostname field as a filter on my dashboards. The Kibana dropdown control panel says this field doesn't exist on any documents in the index pattern. And the dashboard Edit Filter dialog says There aren't any options available. when I try to create a filter.
On another dashboard with a separate (but nearly identical) index pattern, I'm able to use a hostname field as a filter in Kibana just fine. The only difference is on the other index, I didn't have to add the hostname field using Grok. I'm using the filebeat-7.11.0 index pattern as a component template for both index patterns. Filebeat is the original input source to Logstash for both indices. I'm running ES 7.11 on Debian.
I just tried creating a checkpoint.hostname field with logstash grok to see if I was just not using the correct namespace, but that seems to have the same issue.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.