# Host.name field winlogbeat (FQDN) vs filebeat (shortname)

**URL:** <https://discuss.elastic.co/t/host-name-field-winlogbeat-fqdn-vs-filebeat-shortname/228398>\
**Category:** Beats\
**Created:** [April 16, 2020, 8:12pm UTC](https://discuss.elastic.co/t/host-name-field-winlogbeat-fqdn-vs-filebeat-shortname/228398 "2020-04-16T20:12:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jimmburton](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@jimmburton](https://discuss.elastic.co/u/jimmburton)\
**Post date:** [April 16, 2020, 8:12pm UTC](https://discuss.elastic.co/t/host-name-field-winlogbeat-fqdn-vs-filebeat-shortname/228398/1 "2020-04-16T20:12:28Z")

</div>

I have built a brand new 7.6.2 cluster and I am testing SIEM with it as well as making some changes in the architecture and index layout from my old 6.x cluster I have updated a few times.

I have a windows system where I have auditbeat and winlogbeat installed and sending directly to the ES cluster as an output. I have noticed that the host.name field is set to the FQDN from winlogbeat, and the short name is used with auditbeat. This causes the SIEM dashboard to see 2 hosts one with FQDN and one with short name due to the host.name field being different.

I have looked at the logs and the "Beat name:" is set to the short name for both beats.

Is there a way to make the host.name field the shortname of the host fro auditbeat on a windows system?

---

<div class="post-metadata">

**Author:** ![johncollaros](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johncollaros/32/7613_2.png) [@johncollaros](https://discuss.elastic.co/u/johncollaros)\
**Post date:** [April 28, 2020, 2:25am UTC](https://discuss.elastic.co/t/host-name-field-winlogbeat-fqdn-vs-filebeat-shortname/228398/2 "2020-04-28T02:25:13Z")

</div>

Hi,

Just to confirm I am experiencing this problem too.  
I have recently upgraded to 7.6.2 beats from 7.5.0, and I am seeing the same behaviour where winlogbeat sends the FQDN in the host.name field, and all other beats send just the hostname.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 26, 2020, 4:25am UTC](https://discuss.elastic.co/t/host-name-field-winlogbeat-fqdn-vs-filebeat-shortname/228398/3 "2020-05-26T04:25:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.