# Winlogbeat template issue

**URL:** https://discuss.elastic.co/t/winlogbeat-template-issue/146521
**Category:** Beats
**Tags:** winlogbeat
**Created:** [August 29, 2018, 11:35am UTC](https://discuss.elastic.co/t/winlogbeat-template-issue/146521 "2018-08-29T11:35:24Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)
#### Post date: [August 29, 2018, 11:35am UTC](https://discuss.elastic.co/t/winlogbeat-template-issue/146521/1 "2018-08-29T11:35:24Z")

</div>

Hello, we've just upgraded to winlogbeat 6.3.2 and I have uploaded the template and made the necessary change to the beats output in Logstash.  
I can see events in Kibana but the host field is showing incorrectly, instead of simply showing the hostname it shows the below:

![image](https://us1.discourse-cdn.com/elastic/original/3X/6/0/604ebb78e77825af30733cf36289f4f1604901bf.png)

I did modify the index template to change the number of shards, my partial index template is below, I've had to cut it off after the relevant section as there are too many characters for this post:

```
PUT /_template/winlogbeat-6.3.2
{
  "index_patterns": [
      "winlogbeat-6.3.2-*"
    ],
    "settings": {
      "number_of_shards": "33",
      "number_of_replicas": "0",
      "index": {
        "mapping": {
          "total_fields": {
            "limit": "10000"
          }
        },
        "refresh_interval": "5s"
      }
    },
    "mappings": {
      "doc": {
        "dynamic_templates": [
          {
            "fields": {
              "match_mapping_type": "string",
              "path_match": "fields.*",
              "mapping": {
                "type": "keyword"
              }
            }
          },
          {
            "docker.container.labels": {
              "mapping": {
                "type": "keyword"
              },
              "match_mapping_type": "string",
              "path_match": "docker.container.labels.*"
            }
          },
          {
            "event_data": {
              "mapping": {
                "type": "keyword"
              },
              "match_mapping_type": "string",
              "path_match": "event_data.*"
            }
          },
          {
            "user_data": {
              "mapping": {
                "type": "keyword"
              },
              "match_mapping_type": "string",
              "path_match": "user_data.*"
            }
          },
          {
            "strings_as_keyword": {
              "mapping": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "match_mapping_type": "string"
            }
          }
        ],
        "properties": {
          "message": {
            "type": "text",
            "norms": false
          },
          "message_error": {
            "type": "keyword",
            "ignore_above": 1024
          },
          "record_number": {
            "type": "keyword",
            "ignore_above": 1024
          },
          "host": {
            "properties": {
              "name": {
                "type": "keyword",
                "ignore_above": 1024
              },
              "id": {
                "type": "keyword",
                "ignore_above": 1024
              },
              "architecture": {
                "type": "keyword",
                "ignore_above": 1024
              },
              "os": {
                "properties": {
                  "version": {
                    "type": "keyword",
                    "ignore_above": 1024
                  },
                  "family": {
                    "type": "keyword",
                    "ignore_above": 1024
                  },
                  "platform": {
                    "type": "keyword",
                    "ignore_above": 1024
                  }
                }
              }
            }
          },

```

Can anyone help correct this?

Many thanks.

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [August 29, 2018, 1:16pm UTC](https://discuss.elastic.co/t/winlogbeat-template-issue/146521/2 "2018-08-29T13:16:46Z")

</div>

That's correct. The host field has become an object in 6.3 for [ECS compliance](https://github.com/elastic/ecs).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 26, 2018, 1:16pm UTC](https://discuss.elastic.co/t/winlogbeat-template-issue/146521/3 "2018-09-26T13:16:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.