I want to send the external IP address to Logstash instead of what Filebeat is currently sending as beat.hostname. I tried the following:
fields: beat.hostname: 184.108.40.206 fields_under_root: true
But that didn't actually replace the existing field, it just created a new one. I tried surrounding it in brackets - that results in Logstash errors (it didn't like the period). Any ideas?
I know I can just rename the field and then change our software, but I'm interested to see what would make this work in case I can't change the software in the future.
[latest versions for all software]