# SIEM App does not display Hostnames from Beats Events **URL:** \ **Category:** SIEM\ **Created:** [February 21, 2020, 10:15am UTC](https://discuss.elastic.co/t/siem-app-does-not-display-hostnames-from-beats-events/220330 "2020-02-21T10:15:19Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![cknoell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cknoell/32/47353_2.png) [@cknoell](https://discuss.elastic.co/u/cknoell)\ **Post date:** [February 21, 2020, 10:15am UTC](https://discuss.elastic.co/t/siem-app-does-not-display-hostnames-from-beats-events/220330/1 "2020-02-21T10:15:20Z")
Hi, we have some problems using the SIEM App and Displaying Hostnames on the Hosts Page if it comes to a setup where you use: Beats -\> Logstash -\> Logstash -\> Elastic All components are using up to date V7.6.0 Beats can be Auditbeat and Winlogbeat in our case. I know, that if you use a Logstash to Logstah communication you can't use "index =\> "%{[@metadata][beat]}-%{[@metadata][version]}" as indexname value in LS as Logstash does not preserve this information. So we are using agent type and version to set index name/pattern, which is working fine. The index templates and patterns for Auditbeat and Winlogbeat are setted up manually, and "Discover" displays them correctly. All logs have the "host.name" field included, which is, as far as i understood, important for the SIEM App to populate the Hosts Page with Hostnames for Events coming from any possible logsource. Something more which I can check ? Thanks for any advise on this. Br Christopher ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [February 21, 2020, 11:45am UTC](https://discuss.elastic.co/t/siem-app-does-not-display-hostnames-from-beats-events/220330/2 "2020-02-21T11:45:39Z")
Hi, Indeed, `host.name` is what the SIEM app uses to populate the hosts tables. As long as that field is a `keyword` field, things should work fine. Can you check the Elasticsearch mapping for the `auditbeat-*` and paste us the mapping for `host`? In Kibana Console you can do: ```auto GET /auditbeat-*/_mapping ``` And then look for the `host` properties. ---
**Author:** ![cknoell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cknoell/32/47353_2.png) [@cknoell](https://discuss.elastic.co/u/cknoell)\ **Post date:** [February 21, 2020, 12:04pm UTC](https://discuss.elastic.co/t/siem-app-does-not-display-hostnames-from-beats-events/220330/3 "2020-02-21T12:04:45Z")
Hi tudor, thx for answering. Here is the host properties part of the auditbeat-\*/\_mapping. I think that it is defined as a keyword: ``` { "auditbeat-7.6.0-2020.02.18" : { "mappings" : { "properties" : { "@timestamp" : { "type" : "date" }, ... ... ... "host" : { "properties" : { "architecture" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "containerized" : { "type" : "boolean" }, "hostname" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, ``` Br Christopher ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [February 21, 2020, 12:30pm UTC](https://discuss.elastic.co/t/siem-app-does-not-display-hostnames-from-beats-events/220330/4 "2020-02-21T12:30:07Z")
In the above, I see `host.hostname` defined as `text` and `host.hostname.keyword` defined as `keyword`. I assume it's the same for `host.name`. It sounds like you don't have the right mapping template loaded for the Beats data. See this [guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html#load-template-manually) on how to load the template manually. It normally happens automatically when you use Beats -\> Elasticsearch directly, but when there's Logstash in-between you need to do that manually. Note that the template is applied only when new indicies are created, so you might have to either drop the current indices or do an index rotation. ---
**Author:** ![cknoell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cknoell/32/47353_2.png) [@cknoell](https://discuss.elastic.co/u/cknoell)\ **Post date:** [February 21, 2020, 12:58pm UTC](https://discuss.elastic.co/t/siem-app-does-not-display-hostnames-from-beats-events/220330/5 "2020-02-21T12:58:00Z")
I went right through the [alternate method](https://www.elastic.co/guide/en/beats/winlogbeat/7.6/winlogbeat-template.html#load-template-manually-alternate) for loading beats index templates. So is asume that the index templates are correct, as they have been created by auditbeat and winlogbeat itself. I'm going to reindex the indices to use the right templates, as I was missing this step. ---
**Author:** ![cknoell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cknoell/32/47353_2.png) [@cknoell](https://discuss.elastic.co/u/cknoell)\ **Post date:** [February 21, 2020, 10:12pm UTC](https://discuss.elastic.co/t/siem-app-does-not-display-hostnames-from-beats-events/220330/6 "2020-02-21T22:12:36Z")
Reindexing on the correct Index Templates solved the problem. What about using own index templates for custom log sources ? Use of ECS is clear, but correct Index Templates seems to me as one of the key config steps, too. (Beside adding the index patterns to SIEM App config) Is there any additional information on how to define correct index templates for custom logsources to be able to have this data in the SIEM App ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 20, 2020, 10:12pm UTC](https://discuss.elastic.co/t/siem-app-does-not-display-hostnames-from-beats-events/220330/7 "2020-03-20T22:12:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.