When a host is removed from a host group, the audit log entry does not contain the actual hostid of the host.

Instead, it records an internal index in the JSON structure under "hostgroup.hosts[NNNN]", e.g.:

{"hostgroup.hosts[19443]":["delete"]}

There is no corresponding hostid field in this entry.

However, when a host is added to a group, the audit log includes:

{ "hostgroup.hosts[19443]":["add"], "hostgroup.hosts[19443].hostgroupid":["add","19443"], "hostgroup.hosts[19443].hostid":["add","15854"] }

So, during a removal event, it’s impossible to know which host (15854 in this example) was removed from the group.

This makes it impossible to reliably audit or trigger integrations (e.g., via PostgreSQL triggers) that depend on identifying the specific host being removed.

Steps to Reproduce:

1. Go to Configuration → Hosts.

1. Add a host to a host group.

1. Remove the same host from that host group.

1. Check the auditlog.details column (or Zabbix UI → Audit → Actions).

Expected Result:

The details field should include both hostgroupid and the real hostid, e.g.:

{"hostgroup.hosts[19443]":["delete"], "hostgroup.hosts[19443].hostid":["delete","15854"]}