Don't use the reserved host field anymore

[widhalmt]

In 6.4 versions Elasticsearch invented a reserved nested field host.

When Icingabeat connects directly to Elasticsearch it wants to write into the field host like it has done before. (And like almost any user does :-( ) But Elasticsearch will refuse to write the new data into an index.

Please change icingabeat so it won't write a "host" field anymore.

/ref/NC/558885

[widhalmt]

Here is the interesting part out of the logfile:

"reason":"failed to parse [host]","caused_by":{"type":"illegal_state_exception","reason":"Can't get text on a START_OBJECT at 1:49"}}

Can't paste all of the log because there's some company data in it.

[bobapple]

This may be related to #25

[5nafu]

I had this issue when downgrading to 6.1.1 as well (with Elastic 5.5), but this was due to the fact that there are two field definitions for "host" in the icingabeat template. I first changed only one instance and got this issue.

[bobapple]

I moved all icinga related fields to an icinga group, this will solve the issue.