Logstash hostname split up

Question

My hostnames are something like "companyname-instancename".

When the logs get sent to logstash and then stored in elasticsearch, they seem to get split up at the "-".

How can I prevent this in logstash? Do I have to change the hosts field?

Answer 1

Elasticsearch, being a text search engine, is analyzing the data for you and making tokens out of it.

You need to set the field to be not_analyzed to prevent this. Since everyone hits this "problem", logstash will make a ".raw" version of the field for you, eg myField.raw.