How to replace the value of beat.hostname?

Elastic Stack Beats
1

I want to send the external IP address to Logstash instead of what Filebeat is currently sending as beat.hostname. I tried the following:

 fields:
    beat.hostname: 44.112.44.112

 fields_under_root: true

But that didn't actually replace the existing field, it just created a new one. I tried surrounding it in brackets - that results in Logstash errors (it didn't like the period). Any ideas?

I know I can just rename the field and then change our software, but I'm interested to see what would make this work in case I can't change the software in the future.

[latest versions for all software]

2

latest version meaning 1.2.3 or 5.0alpha4?

You can not change beat.hostname, but beat.name. By default beat.name is the hostname.

In version 1.x the beat.name is configured via shipper.name config. See 1.2 docs in shipper config.

In version 5.0alpha4 the shipper config section has been removed and name has become a top-level config option. See docs.

3

This topic was automatically closed after 21 days. New replies are no longer allowed.