Extract server name used by FileBeats to connect to LogStash

Elastic Stack Logstash
1

I've set up multiple FileBeats instances on different machines to send syslog to a single central LogStash server.
I have created ssl certs and have setup SSL communication (as explained in documentation) between FileBeats & LogStash.
Each FileBeats instances uses a different dns name to send logs, but all these dns names resolve to same LogStash instance.
The flow is working fine and I'm seeing logs on LogStash end.

Now, I want to differentiate the incoming logs at LogStash end based on dns name used by FileBeats.
I can't use different ports because there may be hundreds of FileBeats instances and it will not be scalable.

Is there a way to obtain the dns name in LogStash?
Will SNI be available in LogStash?

2

If every filebeat is configured to use a different dns name for logstash, can you also configure them to add that name to the events using a fields option?

3

That is a possible solution.
However, is there any way on LogStash end to extract the dns name used assuming that we can't add a new field on client side?

4

Not that I can think of.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.