Missing destination host

We have a licensing server with its logs containing license id, user name and host to which the license has been assigned. The host is not always domain or ip, it can be some other name. So host.name is the best field for this. But as host refers to the licensing server itself, the better field for this would be destination.host.name.
But host.* is not expected to be nested under the destination unlike user.*. What field should be used instead of destination.host.name? Should not be source/destination/host modified so host could be nested the same/consistent way as the user can?