diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 7f1df7c0d85..496b37838c7 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -43,6 +43,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 * Checkpoint {pull}18754[18754]
 * Netflow {pull}19087[19087]
 * Suricata {pull}19107[19107] (`forwarded` tag is not included by default)
+* CoreDNS {pull}19134[19134] (`forwarded` tag is not included by default)
+* Envoy Proxy {pull}19134[19134] (`forwarded` tag is not included by default)
 - Preserve case of http.request.method.  ECS prior to 1.6 specified normalizing to lowercase, which lost information. Affects filesets: apache/access, elasticsearch/audit, iis/access, iis/error, nginx/access, nginx/ingress_controller, aws/elb, suricata/eve, zeek/http. {issue}18154[18154] {pull}18359[18359]
 - Adds check on `<no value>` config option value for the azure input `resource_manager_endpoint`. {pull}18890[18890]
 - Okta module now requires objects instead of JSON strings for the `http_headers`, `http_request_body`, `pagination`, `rate_limit`, and `ssl` variables. {pull}18953[18953]
diff --git a/x-pack/filebeat/module/coredns/log/config/coredns.yml b/x-pack/filebeat/module/coredns/log/config/coredns.yml
index b2f0ebe4519..be7f27f551f 100644
--- a/x-pack/filebeat/module/coredns/log/config/coredns.yml
+++ b/x-pack/filebeat/module/coredns/log/config/coredns.yml
@@ -3,7 +3,8 @@ paths:
 {{ range $i, $path := .paths }}
   - {{$path}}
 {{ end }}
-tags: {{.tags}}
+tags: {{.tags | tojson}}
+publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}
 processors:
   - add_fields:
       target: ''
diff --git a/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml b/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml
index b2f0ebe4519..be7f27f551f 100644
--- a/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml
+++ b/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml
@@ -3,7 +3,8 @@ paths:
 {{ range $i, $path := .paths }}
   - {{$path}}
 {{ end }}
-tags: {{.tags}}
+tags: {{.tags | tojson}}
+publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}
 processors:
   - add_fields:
       target: ''