Thanks - I'll need to test the processor on Monday though. It's well outside work hours now in my timezone.
As for the
host field, we set it directly in the Beat's config (resolved from Puppet or Ansible facts) - it's not added at the LS Beats input. This is the only reliable way we've found to get a system's FQDN, as Go doesn't appear to be able to resolve them. The
beat.hostname field is a short hostname, so that would cause the name collisions mentioned above.
Given that we're adding
host as part of the Beat's config, will the processor rename the new host object before our custom field is added? If not I'm not sure how this solution would work.
Here's an example config to explain:
filebeat: registry_file: /var/lib/filebeat/registry config.prospectors: enabled: true path: /etc/filebeat/conf.d/*.yml fields: host: sample.host.fqdn timezone: Pacific/Auckland fields_under_root: true output: logstash: hosts: ["ingress1.xxx.xxx:10514", "ingress2.xxx.xxx:10514"] compression_level: 3 ssl: certificate_authorities: ["/etc/ssl/certs/ingress.crt"] verification_mode: full [...]