# Host variable replaced, but not configured to be

**URL:** <https://discuss.elastic.co/t/host-variable-replaced-but-not-configured-to-be/61401>\
**Category:** Logstash\
**Created:** [September 23, 2016, 4:20pm UTC](https://discuss.elastic.co/t/host-variable-replaced-but-not-configured-to-be/61401 "2016-09-23T16:20:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jdmac](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@jdmac](https://discuss.elastic.co/u/jdmac)\
**Post date:** [September 23, 2016, 4:20pm UTC](https://discuss.elastic.co/t/host-variable-replaced-but-not-configured-to-be/61401/1 "2016-09-23T16:20:09Z")

</div>

Hi All,

TLDR; - I suspect http { } is modifying the received host field value, without being explicitly configured to. I need to stop this happening.

* * *

I'm using the following configuration file.

```auto
input {
        http {
                codec => json
        }
}

filter {
        if [type] == "load" {
                mutate {
                        add_field => { "1m" => "%{values[0]}" }
                        add_field => { "5m" => "%{values[1]}" }
                        add_field => { "15m" => "%{values[2]}" }
                }
        }
        if [type] == "if_octets" {
                mutate {
                        add_field => { "rx" => "%{values[0]}" }
                        add_field => { "tx" => "%{values[1]}" }
                }
                ruby {
                        code => "event['rx'] = event['rx'] * 8"
                }
                ruby {
                        code => "event['tx'] = event['tx'] * 8"
                }
        }
        date {
                match => ["time", "UNIX"]
        }
}

output {
        elasticsearch {}
        stdout { codec => rubydebug }
}

```

Before I continue on explaining the issue, I will state the first thing I've checked before pointing a finger at Logstash is that I've used tcpdump to examine the raw JSON coming from collectd to logstash and can see the "host" field has been passed and contains a correct value.

However, once logstash has finished with the event, the host field has been changed to what appears to be the source IP of the http traffic (since I don't have resolutions setup yet).

I really want to be able to disable that behavior some how, because I need the host field to remain correctly set from the collectd sender.

I have already tried to see if a mutate filter to add a new field and copy the original %{host} would work but it too ends up being the source IP... Leading me to suspect some behavior of the http input module.

Although I can't see any explanation or toggle in the documentation - Are there any options I can toggle to disable this behavior?

Many thanks,

jdmac

---

<div class="post-metadata">

**Author:** ![jdmac](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@jdmac](https://discuss.elastic.co/u/jdmac)\
**Post date:** [September 24, 2016, 11:08pm UTC](https://discuss.elastic.co/t/host-variable-replaced-but-not-configured-to-be/61401/2 "2016-09-24T23:08:32Z")

</div>

Anyone have any thoughts on this or experience of evading the variable being replaced?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 25, 2016, 7:44pm UTC](https://discuss.elastic.co/t/host-variable-replaced-but-not-configured-to-be/61401/3 "2016-09-25T19:44:47Z")

</div>

Unfortunately the http input unconditionally overwrites the `host` field:

> <https://github.com/logstash-plugins/logstash-input-http/blob/v3.0.3/lib/logstash/inputs/http.rb#L141>

This is arguable a bug and I've filed an issue for it:

> <https://github.com/logstash-plugins/logstash-input-http/issues/61>

---

<div class="post-metadata">

**Author:** ![jdmac](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@jdmac](https://discuss.elastic.co/u/jdmac)\
**Post date:** [September 25, 2016, 7:56pm UTC](https://discuss.elastic.co/t/host-variable-replaced-but-not-configured-to-be/61401/4 "2016-09-25T19:56:23Z")

</div>

Thanks, I will head over to +1 the bug. Thanks for confirming, I had  
started to look at some of source to see what was doing it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:37am UTC](https://discuss.elastic.co/t/host-variable-replaced-but-not-configured-to-be/61401/5 "2017-07-06T04:37:01Z")

</div>