there is a option host,some logstash agent get the empty values,only one get the real values,I define an index template to slove the not_analyzed,
what metod does the "host" use ? read the logstash agent hostname or some config?
Your post is a little hard to understand, which is ok!
Are you asking where the host
value comes from? If you are ingesting data with Logstash, then it comes from the hostname that is running the Logstash process.
Ok, let me move this to the Logstash category, hopefully someone else can help out too.
thks