Hi Christian,
glad you found something that works for you.
To tie into your earlier question about doing it with winlogbeat processors thats also possible.
processors:
- drop_fields:
fields: [ "host.name" ]
- copy_fields:
fields:
- from: host.hostname
to: host.name
You will have to drop the field first because the copy_fields function cant write into already existing fields.