Can I grok out the host field if its not a valid IP? Also, what is the host field?

[red888 (red der)]

Not sure how to handle this.

I have this in my index template:
"host": {
"type": "IP"
},

In logstash I have this:
input {
tcp {
type => "weblogs"
port => "9999"
}
}

Now on a production server "host" is always a valid IP address, but if Im running a logstash container locally and sending data to it from the host (my laptop) the "host" field is populated as "gateway" for some reason.

I was thinking about groking out the host field if it is not a valid IP, but then i realized I don't even know how this field gets in there. Is this a field logstash injects? it seems to be. And if its always just the IP or hostname of the server I suppose there is no real value to casting it as an IP anyway.

[magnusbaeck (Magnus Bäck)]

It's the tcp input that populates the host field. IIRC the hostname is used if available, otherwise you get an IP address.