Object mapping for [host] tried to parse field [host] as object, but found a concrete value

Chris_Denneen · June 6, 2019, 6:36pm

Host in the ECS spec is an object

elastic/ecs/blob/master/generated/beats/fields.ecs.yml#L1008-L1015


- name: host
  title: Host
  group: 2
  description: 'A host is defined as a general computing instance.


    ECS host.* fields should be populated with details about the host on which the
    event happened, or from which the measurement was taken. Host types include
    hardware, virtual machines, Docker containers, and Kubernetes nodes.'

so now it's

host:
  name: my hostname
  ip: 10.1.10.10

Where "host" encapsulates "host" related data.