diff --git a/metricbeat/module/kibana/cluster_actions/data.go b/metricbeat/module/kibana/cluster_actions/data.go
index 182d7325a22..0cbb839e751 100644
--- a/metricbeat/module/kibana/cluster_actions/data.go
+++ b/metricbeat/module/kibana/cluster_actions/data.go
@@ -90,9 +90,9 @@ func eventMapping(r mb.ReporterV2, content []byte, isXpack bool) error {
 		RootFields: mapstr.M{
 			"service.id":      serviceId,
 			"service.version": version,
-			"service.address": serviceAddress,
 		},
 		MetricSetFields: actionsFields,
+		Host:            fmt.Sprintf("%v", serviceAddress),
 	}
 
 	// xpack.enabled in config using standalone metricbeat writes to `.monitoring` instead of `metricbeat-*`
diff --git a/metricbeat/module/kibana/cluster_rules/data.go b/metricbeat/module/kibana/cluster_rules/data.go
index 85b8093d562..5cc159d6546 100644
--- a/metricbeat/module/kibana/cluster_rules/data.go
+++ b/metricbeat/module/kibana/cluster_rules/data.go
@@ -90,9 +90,9 @@ func eventMapping(r mb.ReporterV2, content []byte, isXpack bool) error {
 		RootFields: mapstr.M{
 			"service.id":      serviceId,
 			"service.version": version,
-			"service.address": serviceAddress,
 		},
 		MetricSetFields: rulesFields,
+		Host:            fmt.Sprintf("%v", serviceAddress),
 	}
 
 	// xpack.enabled in config using standalone metricbeat writes to `.monitoring` instead of `metricbeat-*`
diff --git a/metricbeat/module/kibana/node_actions/data.go b/metricbeat/module/kibana/node_actions/data.go
index ead19bb2052..4423288d952 100644
--- a/metricbeat/module/kibana/node_actions/data.go
+++ b/metricbeat/module/kibana/node_actions/data.go
@@ -86,9 +86,9 @@ func eventMapping(r mb.ReporterV2, content []byte, isXpack bool) error {
 		RootFields: mapstr.M{
 			"service.id":      serviceId,
 			"service.version": version,
-			"service.address": serviceAddress,
 		},
 		MetricSetFields: actionsFields,
+		Host:            fmt.Sprintf("%v", serviceAddress),
 	}
 
 	// xpack.enabled in config using standalone metricbeat writes to `.monitoring` instead of `metricbeat-*`
diff --git a/metricbeat/module/kibana/node_rules/data.go b/metricbeat/module/kibana/node_rules/data.go
index 6ded4d3bf39..2aa889cc3ed 100644
--- a/metricbeat/module/kibana/node_rules/data.go
+++ b/metricbeat/module/kibana/node_rules/data.go
@@ -86,9 +86,9 @@ func eventMapping(r mb.ReporterV2, content []byte, isXpack bool) error {
 		RootFields: mapstr.M{
 			"service.id":      serviceId,
 			"service.version": version,
-			"service.address": serviceAddress,
 		},
 		MetricSetFields: rulesFields,
+		Host:            fmt.Sprintf("%v", serviceAddress),
 	}
 
 	// xpack.enabled in config using standalone metricbeat writes to `.monitoring` instead of `metricbeat-*`
diff --git a/metricbeat/module/kibana/stats/data.go b/metricbeat/module/kibana/stats/data.go
index 1675772ae05..2b0ca12ef20 100644
--- a/metricbeat/module/kibana/stats/data.go
+++ b/metricbeat/module/kibana/stats/data.go
@@ -158,6 +158,7 @@ func eventMapping(r mb.ReporterV2, content []byte, isXpack bool) error {
 		return event.Error
 	}
 	_, _ = event.RootFields.Put("service.address", serviceAddress)
+	event.Host = fmt.Sprintf("%v", serviceAddress)
 
 	// Set process PID
 	process, ok := data["process"].(map[string]interface{})