# How does Logstash know the host.hostname field?
**URL:** https://discuss.elastic.co/t/how-does-logstash-know-the-host-hostname-field/342666
**Category:** Logstash
**Created:** [September 9, 2023, 7:34pm UTC](https://discuss.elastic.co/t/how-does-logstash-know-the-host-hostname-field/342666 "2023-09-09T19:34:56Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Poubelle\_Dirty](https://discuss.elastic.co/u/Poubelle_Dirty)
#### Post date: [September 9, 2023, 7:34pm UTC](https://discuss.elastic.co/t/how-does-logstash-know-the-host-hostname-field/342666/1 "2023-09-09T19:34:56Z")
Hello,
I don't find the information and I think it's about ECS. I have a really simple config on logtash that uses syslog input, grok parsing and inject into elastic cluster.
```auto
input {
syslog {
host => "0.0.0.0"
port => 10514
}
}
```
But the logs that are shown in kibana contains the host.hostname from the remote machine sending logs to logstash (with syslog). How is this done ? How by default, this information about the hostname is known ? What could cause this information not to be gathered by logstash ?
Thank you !
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 9, 2023, 9:47pm UTC](https://discuss.elastic.co/t/how-does-logstash-know-the-host-hostname-field/342666/2 "2023-09-09T21:47:21Z")
> [@Poubelle\_Dirty](#):
>
> How is this done ? How by default, this information about the hostname is known ?
When you receive data from a socket the remote address connected to that socket is available. The code is [here](https://github.com/logstash-plugins/logstash-input-syslog/blob/7a544560fd7171105f27ffd66db7dc49b542345e/lib/logstash/inputs/syslog.rb#L226).
---
### Author:  [@Poubelle\_Dirty](https://discuss.elastic.co/u/Poubelle_Dirty)
#### Post date: [September 10, 2023, 7:35am UTC](https://discuss.elastic.co/t/how-does-logstash-know-the-host-hostname-field/342666/3 "2023-09-10T07:35:44Z")
Ok thank you I can understand why the IP can be known but in here this is the hostname of the machine that is gathered (configure by the command hostnamectl)
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [September 10, 2023, 12:50pm UTC](https://discuss.elastic.co/t/how-does-logstash-know-the-host-hostname-field/342666/4 "2023-09-10T12:50:57Z")
> [@Poubelle\_Dirty](#):
>
> How is this done ? How by default, this information about the hostname is known ? What could cause this information not to be gathered by logstash ?
The `syslog` input has a built-in `grok` pattern configured that will parse your original syslog message, so if the original hostname is present in the syslog message, then it will populate the field `host.hostname`.
This part of the [code](https://github.com/logstash-plugins/logstash-input-syslog/blob/7a544560fd7171105f27ffd66db7dc49b542345e/lib/logstash/inputs/syslog.rb#L98C25-L101) tells you which pattern it will use and this is the [file](https://github.com/logstash-plugins/logstash-patterns-core/blob/f01f3f34cfab13a28b0822bdba33db41823cb1d8/patterns/ecs-v1/linux-syslog) with the patterns used.
The value of `host.hostname` comes from the original message.
---
### Author:  [@Poubelle\_Dirty](https://discuss.elastic.co/u/Poubelle_Dirty)
#### Post date: [September 10, 2023, 3:17pm UTC](https://discuss.elastic.co/t/how-does-logstash-know-the-host-hostname-field/342666/5 "2023-09-10T15:17:26Z")
Ok I totally get it now ! Many thanks !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 8, 2023, 3:18pm UTC](https://discuss.elastic.co/t/how-does-logstash-know-the-host-hostname-field/342666/6 "2023-10-08T15:18:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.