Fixed host.ip field
@@ -132,8 +132,10 @@ filter {
}
if [host][ip_ext] {
mutate {
- add_field => { "[host][domain_ext]" => "%{[host][ip_ext]}" }
- copy => { "[host][ip_ext]" => "[host][ip]" }
+ add_field => {
+ "[host][domain_ext]" => "%{[host][ip_ext]}"
+ "[host][ip]" => "%{[host][ip_ext]}"
+ }
}
# do reverse DNS lookup
dns {
