False Host field filled for expired events with the new mapping generated by filebeat

[Shaoranlaos]

• Version: 4.1.0

The plugin adds the host field false to the expired events for the new mapping that is generated from filebeat.

current mapping:
hostname in field host as keyword

new mapping:
hostname in subfield [host][name] as keyword

[cballarin]

Any news on this one, or a suggested workaround?