# Hostname Tokenizer

**URL:** <https://discuss.elastic.co/t/hostname-tokenizer/27046>\
**Category:** Elasticsearch\
**Created:** [August 7, 2015, 1:11pm UTC](https://discuss.elastic.co/t/hostname-tokenizer/27046 "2015-08-07T13:11:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Telmo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/telmo/32/4092_2.png) [@Telmo](https://discuss.elastic.co/u/Telmo)\
**Post date:** [August 7, 2015, 1:11pm UTC](https://discuss.elastic.co/t/hostname-tokenizer/27046/1 "2015-08-07T13:11:12Z")

</div>

We are running into an issue where Elasticsearch tokenizer is splitting the hostname at the '-' the standard for host name convention where I work is

```
<app>-<location>-id 

```

so instead of elasticsearch-ny-001 we end up with "elasticsearch", "ny", "001" I have searched everywhere for an implementation of this even in this forum where a solution involving replacing the - with a . was proposed but for reporting we need to maintain the full hostname as it is. I have tried the following template but it did not have the desired outcome.

```
curl -XPUT http://localhost:9200/_template/logstash -d '
{
    "template": "*logstash*",
    "settings" : {
            "number_of_shards" : 1
    },
    "mappings" : {
            "file" : {
                    "properties" : {
                            "host" : {
                                    "type" : "string",
                                    "index" : "not_analyzed"
                            },
                            "environment" : {
                                    "type" : "string",
                                    "index" : "not_analyzed"
                            },
                            "path" : {
                                    "type" : "string",
                                    "index" : "not_analyzed"
                            }
                    }
            }
    }
}

```

I am aware that logstash sets the tokenizer by default, but we are using fluentd to publish the data and not logstash and I can't find anywhere in the logstash github repo where the tokenizer is set.

Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 7, 2015, 11:35pm UTC](https://discuss.elastic.co/t/hostname-tokenizer/27046/2 "2015-08-07T23:35:09Z")

</div>

Is fluentd using the logstash index pattern?  
Cause if so that should definitely work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:56pm UTC](https://discuss.elastic.co/t/hostname-tokenizer/27046/3 "2017-07-05T23:56:44Z")

</div>