In order to avoid it on the LS side
# Remove host metadata
mutate {
remove_field => [ "[host][name]" ]
remove_field => [ "[host][id]" ]
remove_field => [ "[host][architecture]" ]
remove_field => [ "[host][os][platform]" ]
remove_field => [ "[host][os][version]" ]
remove_field => [ "[host][os][family]" ]
remove_field => [ "[host][ip]" ]
remove_field => [ "[host][mac]" ]
remove_field => [ "[host][os]" ]
remove_field => [ "[host]" ]
}
mutate {
add_field => {
"host" => "%{[beat][hostname]}"
}
}