Logstash errors after upgrading to filebeat-6.3.0

Thanks for testing. I need to test this also on my end but an other thing you could try is adding host field under and other name and then use the rename processor after you renamed the host.* fields. But not 100% sure it will work.

The general problem is that fields: * existed before the processor existed which makes it a bit special, meaning you can define the order it is executed. That is why I want to replace it by a processor: https://github.com/elastic/beats/issues/7350 If the above does not work, sounds like we should increase the priority for it.