Logstash 8 grok is resolving host.name as host.hostname

[leandrojmp (Leandro Pereira)]

@Jose_E

But I also have the same issue when I don't initially parse the host.name, it only populates host.hostname.

This is because in Logstash 8 ecs compatibility is enabled by default and then all default patterns will parse into ecs fields.

Your [host][hostname] is probably being populated because you are using the SYSLOGBASE pattern, which is defined here.

The ecs compatibility being enabled by default is considered a breaking change and is mentioned here.