# Normalizing Host Name

**URL:** <https://discuss.elastic.co/t/normalizing-host-name/319124>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [November 16, 2022, 6:21pm UTC](https://discuss.elastic.co/t/normalizing-host-name/319124 "2022-11-16T18:21:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tim\_Mobley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_mobley/32/94741_2.png) [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\
**Post date:** [November 16, 2022, 6:21pm UTC](https://discuss.elastic.co/t/normalizing-host-name/319124/1 "2022-11-16T18:21:00Z")

</div>

I am getting values for the `host.name` field in both upper and lower case, which makes searches difficult. What is the _simplest_ way to normalize this field so that it in converted to all caps?

---

<div class="post-metadata">

**Author:** ![Tim\_Mobley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_mobley/32/94741_2.png) [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\
**Post date:** [November 18, 2022, 12:37pm UTC](https://discuss.elastic.co/t/normalizing-host-name/319124/2 "2022-11-18T12:37:13Z")

</div>

I found [this documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/uppercase-processor.html#uppercase-processor) on the uppercase processor using ingest nodes, but is the same not possible in Beats? In this case, I'm using Metricbeat sending directly to ES hot data nodes. I don't see anything applicable in the [list of Metricbeat processors](https://www.elastic.co/guide/en/beats/metricbeat/current/defining-processors.html). I do have Logstash, but would prefer not to use it for this if avoidable.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 19, 2022, 4:31pm UTC](https://discuss.elastic.co/t/normalizing-host-name/319124/3 "2022-11-19T16:31:34Z")

</div>

hi @Tim_Mobley

Hmmm.... Easiest / most maintainable

Options I see are

1. Add the uppercase processor the metricbeat ingest pipeline (probably not great)

2. Change the host.name mapping and use a normalizer (probably not great, changing the core metricbeat mapping)

3. Add a [script processor](https://www.elastic.co/guide/en/beats/metricbeat/current/processor-script.html) to upper case in metricbeat, that may be simplest / most maintainable.

I did this / added to my metricbeat.yml in the processor section...it worked, you could externalize it if you want to make it more maintainable.

```auto
  - script:
      lang: javascript
      source: >
        function process(event) {
            var hostUpperCase = event.Get("host.name").toUpperCase();
            var old = event.Put("host.name", hostUpperCase);
            return event;
        }

```

---

<div class="post-metadata">

**Author:** ![Tim\_Mobley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_mobley/32/94741_2.png) [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\
**Post date:** [November 29, 2022, 9:09pm UTC](https://discuss.elastic.co/t/normalizing-host-name/319124/4 "2022-11-29T21:09:12Z")

</div>

#3 worked, but as an interesting side-effect it wiped out all my other `host` objects. For instance, `host.os.platform`, `host.architecture` and others are all blank now. Not sure why that is, but I guess I can live with that.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 29, 2022, 9:16pm UTC](https://discuss.elastic.co/t/normalizing-host-name/319124/5 "2022-11-29T21:16:00Z")

</div>

Hmmm.... Did not think that would happen...

I'll have to look at it again..  
Perhaps something to do with the JavaScript objects.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2022, 11:16pm UTC](https://discuss.elastic.co/t/normalizing-host-name/319124/6 "2022-12-27T23:16:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.