[Urgent] How to fix host issue in filebeat-7.17.4 without drop_fields

Elastic Stack Beats
1

Hi Team,

Stuck in one issue if I drop_fields of host then it will work otherwise not working

Working condition code:

- drop_fields:
      fields: ["beat", "offset", "source", "type", "input_type", "host"]
      ignore_missing: true

Not Working condition code:

rocessors:
  - drop_fields:
      fields: ["beat", "offset", "source", "type", "input_type"]
      ignore_missing: true

Error is here :=>

Could not index event to Elasticsearch.status: 400, action:
"type" => "mapper_parsing_exception", "reason" => "failed to parse field [host] of type [text] in document with id ''. Preview of field's value: '{name=hostname}'", "caused_by" => {
				"type" => "illegal_state_exception", "reason" => "Can't get text on a START_OBJECT at 1:468"

Please suggest on this

2

Please don't create multiple topics on the same topic, it makes it much harder for people to help :slight_smile: