# How to avoid host.name field in filebeat
**URL:** https://discuss.elastic.co/t/how-to-avoid-host-name-field-in-filebeat/327578
**Category:** Beats
**Tags:** filebeat
**Created:** [March 13, 2023, 3:58pm UTC](https://discuss.elastic.co/t/how-to-avoid-host-name-field-in-filebeat/327578 "2023-03-13T15:58:50Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)
#### Post date: [March 13, 2023, 3:58pm UTC](https://discuss.elastic.co/t/how-to-avoid-host-name-field-in-filebeat/327578/1 "2023-03-13T15:58:50Z")
Hi Team,
I am sending data to elasticsearch using filebeat once the file were harvested I can see field
`host.name` where the value is hostname of the VM
```
{
"_index": "filebeat-7.17.6-2023.03.13-000001",
"_type": "_doc",
"_id": "wGdI24YBQ3WX0oT6tKyJ",
"_score": 1.0,
"_source": {
"@timestamp": "2023-03-13T14:03:38.455Z",
"agent": {
"name": "logstash",
"type": "filebeat",
"version": "7.17.6",
"hostname": "logstash",
"ephemeral_id": "6f61b3c8-4867-470a-834b-6389c7e848d9",
"id": "e4e34578-5252-4493-ab90-380affaa6a3f"
},
"log": {
"offset": 514,
"file": {
"path": "/home/ganeshbabu_lab/filebeat-7.17.6-linux-x86_64/seven.log"
}
},
"message": "testing the filebeat",
"input": {
"type": "filestream"
},
"fields": {
"host": "filebeat-test",
"level": "debug",
"review": 1
},
"ecs": {
"version": "1.12.0"
},
"host": {
"name": "logstash"
}
}
}
```
By default `host.name` field is coming in every events processed through filebeat.
How to avoid `host.name` in json by default?
> **[Host Fields | Elastic Common Schema (ECS) Reference \[1.12\] | Elastic](https://www.elastic.co/guide/en/ecs/1.12/ecs-host.html)**
Using drop fields i can able to remove the `host.name`. Is there any option in filebeat not to send `host.name`
Please let me know your thoughts.
Thanks,
Ganeshbabu R
---
### Author:  [@amanv](https://discuss.elastic.co/u/amanv)
#### Post date: [March 20, 2023, 12:14pm UTC](https://discuss.elastic.co/t/how-to-avoid-host-name-field-in-filebeat/327578/2 "2023-03-20T12:14:59Z")
Hi @r.ganeshbabu. You could make use of the `drop_fields` [processor](https://www.elastic.co/guide/en/beats/filebeat/current/drop-fields.html). If that's what you've already tried, please respond back on this thread.
---
### Author:  [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)
#### Post date: [March 20, 2023, 12:19pm UTC](https://discuss.elastic.co/t/how-to-avoid-host-name-field-in-filebeat/327578/3 "2023-03-20T12:19:06Z")
Use Something like this in filebeat.yml:
```auto
processors:
- add_host_metadata: null
- drop_fields:
when:
equals:
agent.type: filebeat
fields:
- agent.hostname
- agent.id
- agent.type
- agent.ephemeral_id
- agent.version
- log.offset
- log.flags
- input.type
- ecs.version
- host.os
- host.id
- host.mac
- host.architecture
```
---
### Author:  [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)
#### Post date: [March 20, 2023, 12:24pm UTC](https://discuss.elastic.co/t/how-to-avoid-host-name-field-in-filebeat/327578/4 "2023-03-20T12:24:07Z")
Thanks for sharing the details.. I have used drop fields processor in filebeat config
Thanks
Ganeshbabu R
---
### Author:  [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)
#### Post date: [March 21, 2023, 4:06pm UTC](https://discuss.elastic.co/t/how-to-avoid-host-name-field-in-filebeat/327578/5 "2023-03-21T16:06:24Z")
Specific to the fields for add\_host\_metadata (host.\*), you can use:
`publisher_pipeline.disable_host: true`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 18, 2023, 6:06pm UTC](https://discuss.elastic.co/t/how-to-avoid-host-name-field-in-filebeat/327578/6 "2023-04-18T18:06:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.