Hostname not extracted when i run logstash as a service on rhel

Elastic Stack Logstash
1

Hi
When i run logstash normally like this:
./logstash -f logstash.cfg

It extract hostname.

But when i run as service not extract hostname.

Any idea?
Thanks

2

What OS?

share your logstash.cfg

Share sample document with and without

3

@stephenb, os is rhel8

input {
  file {
    path => "/home/app/logs/2023.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    exclude => ["*.gz" , "*.bz2" , "*.slice" ]
    codec => plain { charset => "UTF-8" }
  }
}


filter {

    mutate
    {
        replace => { "host" => "${HOSTNAME}"}

        replace => { "IP_INFLUX" => "192.168.1.1"}
        replace => { "BUCKET_INFLUX" => "mybucket"}
        replace => { "TOKEN_INFLUX" =>  "mytoken"}
        replace => { "ORG_INFLUX" => "myorg"}
    }

    mutate
    {
        replace => { "URL" => "http://%{[IP_INFLUX]}:8087/api/v2/write?bucket=%{[BUCKET_INFLUX]}&precision=s&org=%{[ORG_INFLUX]}"}
    }


output
{
    if "GW_In" in [tags]

    {
  http {
    url => "%{[URL]}"
    http_method => "post"
    format => message
    message => 'APP_In,Thread=%{[Thread]},host=%{[host]},R=%{[R]},I=%{[I]} uid="%{[uid]}"'

    headers => [
      'Authorization', 'Token %{[TOKEN_INFLUX]}'
    ]
  }
4

And what do the output documents look like for each?

5

Oh you're doing that! Well that's because when you start as the system service that environment variable is not set.

You should be getting the host.name as part of the event

What version?

Perhaps look at

6

@stephenb logstash 8.11

7

Did you see my previous post... Probably explains your issue.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.