# Filebeat - Overwrite hostname from decoded json

**URL:** https://discuss.elastic.co/t/filebeat-overwrite-hostname-from-decoded-json/256537
**Category:** Beats
**Tags:** filebeat
**Created:** [November 24, 2020, 4:25pm UTC](https://discuss.elastic.co/t/filebeat-overwrite-hostname-from-decoded-json/256537 "2020-11-24T16:25:08Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Ajay\_Singh2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajay_singh2/32/68920_2.png) [@Ajay\_Singh2](https://discuss.elastic.co/u/Ajay_Singh2)
#### Post date: [November 24, 2020, 4:25pm UTC](https://discuss.elastic.co/t/filebeat-overwrite-hostname-from-decoded-json/256537/1 "2020-11-24T16:25:08Z")

</div>

Hi,

I am trying to ingest a json file using filebeat, here are few logs from the file:

```auto
{"iso.gov.dd.internet.public.enterprises.7.0.1.3.0":23,"@timestamp":"2020-11-24T09:09:09.875Z","host":"1.2.3.4","@version":"1"}
{"iso.gov.dod.internet.public.enterprises.7.0.1.3.0":23,"@timestamp":"2020-11-24T09:14:09.984Z","host":"1.2.3.4","@version":"1"}

```

Here is how my filebeat.yml configuration:

```auto
- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /root/test.log
  json.add_error_key: true
  json.keys_under_root: true
  json.message_key: "iso.gov.dod.internet.public.enterprises.7.0.1.3.0"
processors:
  - decode_json_fields:
    fields: ['message']
    target: json

```

Now, i am having two issues:

1. Getting error - Key 'iso.gov.dod.internet.public.enterprises.7.0.1.3.0' not found
2. i need to overwrite the host.name with host value decoded from the json - (Priority 🙂 )

---

<div class="post-metadata">

### Author: ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [November 25, 2020, 2:41am UTC](https://discuss.elastic.co/t/filebeat-overwrite-hostname-from-decoded-json/256537/2 "2020-11-25T02:41:54Z")

</div>

> [@Ajay\_Singh2](#):
>
> Getting error - Key 'iso.gov.dod.internet.public.enterprises.7.0.1.3.0' not found

That's probably because there is no such key in your first sample entry. I think there's a typo in that entry: `dd` instead of `dod`?

> [@Ajay\_Singh2](#):
>
> i need to overwrite the host.name with host value decoded from the json - (Priority 🙂 )

I was able to accomplish this with the following configuration:

```auto
filebeat.inputs:
- type: log
  paths:
    - /root/test.log
  json.add_error_key: true

processors:
  - drop_fields:
     fields:
       - host.name
  - copy_fields:
      fields:
        - from: json.host
          to: host.name

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 23, 2020, 4:41am UTC](https://discuss.elastic.co/t/filebeat-overwrite-hostname-from-decoded-json/256537/3 "2020-12-23T04:41:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.