host.hostname has cardinality 100 while host.id has cardinality 50.
This happen because in the dataset there is a host.if per each couple
ho hostnames, like a single host.id and for each of them two hostnames
like 'dustin.windows' and 'dustin.linux'. This is probably an artifact
of the data generation script.

Lower cardinality fields might:
* reduce sorting overhead due to less comparisons
* improve compression due to more data clustering together

This change should at least allow us if there is any benefit in choosing
a lower cardinality field.