How to write remote hostname to output file with logstash

Elastic Stack Logstash
1

Hi,

I have java application which is running at 2 instance and collect logs from these instances.

I want to create output log file so far as remote hostname.

my logstash config;

input {
  tcp {
    codec => json
    port => 12345
  }
}

output {
  file {
    codec => json_lines
    path => "/data/logs/%{[application]}-%{[hostname]}.log-%{+YYYY-MM-dd}"
  }
}

output file created like this;

-rw-r--r--. 1 logstash logstash 7.1K Jun 25 11:32 analytic-rt-%{[hostname]}.log-2022-06-25
-rw-r--r--. 1 logstash logstash 5.1K Jun 25 11:32 alarm-%{[hostname]}.log-2022-06-25

I cant see my remote hostname here.

2

Hello @Yunus_Dal

Welcome to Elastic Community :slight_smile: !!!

Just mention the field name like %{hostname}. Hoping hostname would be your field name

path => "/data/logs/%{[application]}-%{hostname}.log-%{+YYYY-MM-dd}"

Keep Posted with updates how it goes !!! Thanks !!!

3

Your output means that you do not have the field hostname in your document.

You need to use %{[host]} instead of %{[hostname]}, if you are using Logstash 8 or have the pipeline.ecs_compatibility enabled, you would need to use %{[@metadata][input][tcp][source][name]}.

You can check the metadata fields availables in the documentation.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.