minor fix for for cisagov#354, set host.name correctly

mmguero-dev · Jan 7, 2025 · 0f69adb · 0f69adb
1 parent 83d7485
commit 0f69adb
Showing 1 changed file with 3 additions and 4 deletions.
diff --git a/logstash/pipelines/beats/11_beats_logs.conf b/logstash/pipelines/beats/11_beats_logs.conf
@@ -840,10 +840,9 @@ filter {
              replace => { "[event][module]" => "syslog" } }
 
     # store the originating host name as host.name as it's probably what people will want to search by
-    if ([hostname]) {
-      mutate { id => "mutate_syslog_direct_add_ecs_hostname"
-               add_field => { "[log][syslog][hostname]" => "%{[hostname]}" } }
-    }
+    if ([log][syslog][hostname]) { mutate { id => "mutate_syslog_direct_replace_hostname"
+                                            replace => { "[host][name]" => "%{[log][syslog][hostname]}" }
+                                            remove_field => [ "[hostname]" ] } }
 
     if (![event][hash]) {
       fingerprint {