# Filtering based on hostname in metricbeat indices

**URL:** <https://discuss.elastic.co/t/filtering-based-on-hostname-in-metricbeat-indices/190792>\
**Category:** Elasticsearch\
**Created:** [July 16, 2019, 4:41pm UTC](https://discuss.elastic.co/t/filtering-based-on-hostname-in-metricbeat-indices/190792 "2019-07-16T16:41:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![amitavmohanty01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amitavmohanty01/32/58017_2.png) [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\
**Post date:** [July 16, 2019, 4:41pm UTC](https://discuss.elastic.co/t/filtering-based-on-hostname-in-metricbeat-indices/190792/1 "2019-07-16T16:41:02Z")

</div>

I am having metricbeat pushing data to Elasticsearch. A document of the index appeats like the following:

```
{
        "_index" : "metricbeat-system-2019.07.16",
        "_type" : "doc",
        "_id" : "F1nl-WsB5ioPniMf8fmp",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2019-07-16T08:28:44.731Z",
          "event" : {
            "dataset" : "system.process",
            "duration" : 69828626
          },
          "system" : {
            "process" : {
              "cpu" : {
                "total" : {
                  "value" : 0,
                  "pct" : 0,
                  "norm" : {
                    "pct" : 0
                  }
                },
                "start_time" : "2019-06-05T23:29:26.000Z"
              },
              "ppid" : 2,
              "pgid" : 0,
              "state" : "sleeping",
              "memory" : {
                "share" : 0,
                "size" : 0,
                "rss" : {
                  "bytes" : 0,
                  "pct" : 0
                }
              },
              "pid" : 3527,
              "name" : "scsi_tmf_29",
              "username" : "root",
              "fd" : {
                "open" : 0,
                "limit" : {
                  "soft" : 1024,
                  "hard" : 4096
                }
              }
            }
          },
          "fields" : {
            "module" : "system"
          },
          "beat" : {
            "name" : "elklogstash01.mydc",
            "hostname" : "elklogstash01.mydc",
            "version" : "6.6.1"
          },
          "host" : {
            "name" : "elklogstash01.mydc"
          },
          "metricset" : {
            "name" : "process",
            "module" : "system",
            "rtt" : 69828
          }
        }
      }

```

I want to search by hostname so I am using the following query. However, the results are not honoring the filter.

```
GET metricbeat-system-2019.07.16/_search
{
  "aggs": {
    "data": {
      "filters": {
        "filters": {
          "hostname_filter": {
            "match": {
              "host.name":"elkkafka01.mydc"}
          }
        }
      }
    }
  }
}

```

Any suggestions ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2019, 4:41pm UTC](https://discuss.elastic.co/t/filtering-based-on-hostname-in-metricbeat-indices/190792/2 "2019-08-13T16:41:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.