Hostname not extracted when i run logstash as a service on rhel

[stephenb (Stephen Brown)]

@Indeed2000

replace => { "host" => "${HOSTNAME}"}

Oh you're doing that! Well that's because when you start as the system service that environment variable is not set.

You should be getting the host.name as part of the event

What version?

Perhaps look at

Why doesn't add_tag => ["${HOSTNAME}"] work?

@magnusbaeck, With the help of elastic support, we figured this out. Turns out it was 2 easy changes to get it working. I am not saying that it was easy figuring this out, because it wasn't easy! mutate { add_tag => ["${HOSTNAME}"] } Add xpack.management.pipeline.id: to logstash.yml Create file, /etc/sysconfig/logstash, (chmod 600) and add these 2 lines HOSTNAME=ThisHostName LOGSTASH_KEYSTORE_PASS=password Thanks again for your help!