Hosts duplicated with and without fqdn

Elastic Security SIEM
7

Hi Christian,

glad you found something that works for you.
To tie into your earlier question about doing it with winlogbeat processors thats also possible.

processors:
  -  drop_fields:
      fields: [ "host.name" ]
  - copy_fields:
      fields:
        - from: host.hostname
          to: host.name

You will have to drop the field first because the copy_fields function cant write into already existing fields.