# Problem with "host" field when parsing linux system logs with Filebeat pipeline

**URL:** <https://discuss.elastic.co/t/problem-with-host-field-when-parsing-linux-system-logs-with-filebeat-pipeline/195931>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 20, 2019, 12:42pm UTC](https://discuss.elastic.co/t/problem-with-host-field-when-parsing-linux-system-logs-with-filebeat-pipeline/195931 "2019-08-20T12:42:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![smerzlyakov](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\
**Post date:** [August 20, 2019, 12:42pm UTC](https://discuss.elastic.co/t/problem-with-host-field-when-parsing-linux-system-logs-with-filebeat-pipeline/195931/1 "2019-08-20T12:42:51Z")

</div>

When i parse linux auth.log, i get error (in Kibana):  
`error.message: cannot set [hostname] with parent object of type [java.lang.String] as part of path [host.hostname]`  
It looks like

 ![10](https://us1.discourse-cdn.com/elastic/original/3X/7/4/74195514bec44640263af4c3fbcc94da94151784.png)  
I ingest logs in Elastic from existing collector, so i use pipeline. Config is:

```
input {
      udp {
        port => 10002
        codec => line
      }
    }

    filter {
      if "linux_secure" in [tags]{
        mutate {
          add_field => { "[@metadata][pipeline]" => "filebeat-7.2.0-system-auth-pipeline" }
        }
      }
    }

    output {
      if "linux_secure" in [tags]{
        elasticsearch {
          pipeline => "%{[@metadata][pipeline]}"
          hosts => ["elk-1:9200"]
          index => 'filebeat-linux_secure-12-%{+YYYY.MM.dd}'
        }
      }
    }

```

Could you please tell me how can i debug the problem?Some steps.

---

<div class="post-metadata">

**Author:** ![faec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faec/32/46988_2.png) [@faec](https://discuss.elastic.co/u/faec)\
**Post date:** [August 22, 2019, 6:39pm UTC](https://discuss.elastic.co/t/problem-with-host-field-when-parsing-linux-system-logs-with-filebeat-pipeline/195931/2 "2019-08-22T18:39:40Z")

</div>

Hi,

Is this your full `filebeat.yml`? You're using a default udp input with no processors, etc.? The error looks like an index configuration issue, as though the standard field `host.hostname` is failing to index because the index template thinks that `host` is a string. Can you check your index templates? (e.g. run `GET /_template/filebeat*` in the kibana console)

---

<div class="post-metadata">

**Author:** ![smerzlyakov](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\
**Post date:** [August 28, 2019, 5:07pm UTC](https://discuss.elastic.co/t/problem-with-host-field-when-parsing-linux-system-logs-with-filebeat-pipeline/195931/3 "2019-08-28T17:07:21Z")

</div>

> [@smerzlyakov](#):
>
> error.message: cannot set [hostname] with parent object of type [java.lang.String] as part of path [host.hostname]

Hello!  
I think i found a problem - udp plugin add field host by default and breaks ECS.  
Same issue [Move the `host` field to a location in line with ECS or make it configurable · Issue #42 · logstash-plugins/logstash-input-udp · GitHub](https://github.com/logstash-plugins/logstash-input-udp/issues/42)  
Very bad behavior.  
So, i think i found the solution - now (since this commit [Make source IP field configurable by praseodym · Pull Request #43 · logstash-plugins/logstash-input-udp · GitHub](https://github.com/logstash-plugins/logstash-input-udp/pull/43)) there is an option in UDP plugin.  
[Udp input plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-udp.html#plugins-inputs-udp-source_ip_fieldname)  
So, i add a string to udp input block:  
`source_ip_fieldname => "host.ip"`  
Now it works, but i dont sure is this field name is best solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 25, 2019, 5:11pm UTC](https://discuss.elastic.co/t/problem-with-host-field-when-parsing-linux-system-logs-with-filebeat-pipeline/195931/4 "2019-09-25T17:11:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.