Normalizing Host Name

[Tim_Mobley]

I am getting values for the host.name field in both upper and lower case, which makes searches difficult. What is the simplest way to normalize this field so that it in converted to all caps?

[Tim_Mobley]

I found this documentation on the uppercase processor using ingest nodes, but is the same not possible in Beats? In this case, I'm using Metricbeat sending directly to ES hot data nodes. I don't see anything applicable in the list of Metricbeat processors. I do have Logstash, but would prefer not to use it for this if avoidable.

[stephenb (Stephen Brown)]

hi @Tim_Mobley

Hmmm.... Easiest / most maintainable

Options I see are

1. Add the uppercase processor the metricbeat ingest pipeline (probably not great)

2. Change the host.name mapping and use a normalizer (probably not great, changing the core metricbeat mapping)

3. Add a script processor to upper case in metricbeat, that may be simplest / most maintainable.

I did this / added to my metricbeat.yml in the processor section...it worked, you could externalize it if you want to make it more maintainable.

  - script:
      lang: javascript
      source: >
        function process(event) {
            var hostUpperCase = event.Get("host.name").toUpperCase();
            var old = event.Put("host.name", hostUpperCase);
            return event;
        }

[Tim_Mobley]

#3 worked, but as an interesting side-effect it wiped out all my other host objects. For instance, host.os.platform, host.architecture and others are all blank now. Not sure why that is, but I guess I can live with that.

[stephenb (Stephen Brown)]

Hmmm.... Did not think that would happen...

I'll have to look at it again..
Perhaps something to do with the JavaScript objects.