Add Logstash host name to JSON formatted logstream

Elastic Stack Logstash
4

You can use a json filter to parse that JSON string, but if that's not the hostname you're interested in perhaps it doesn't matter.

I glanced at the logstash hostname link, and that makes sense, my only concern is does it make that socket call for every event is processed?

Yes, but I'd expect it to be a cheap operation. Otherwise you should be able to fetch the hostname once when the filter initializes and reuse that value for each event. Something like this might work:

ruby {
  init => "
    require 'socket'
    @@hostname = Socket.gethostname
  "
  code => "event.set('host', @@hostname)"