# Impossible to overwrite "host.ip" when using Custom Logs integration
**URL:** https://discuss.elastic.co/t/impossible-to-overwrite-host-ip-when-using-custom-logs-integration/298348
**Category:** Beats
**Tags:** docker, filebeat, elastic-agent
**Created:** [February 27, 2022, 5:05am UTC](https://discuss.elastic.co/t/impossible-to-overwrite-host-ip-when-using-custom-logs-integration/298348 "2022-02-27T05:05:31Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Twyzz](https://discuss.elastic.co/u/Twyzz)
#### Post date: [February 27, 2022, 5:05am UTC](https://discuss.elastic.co/t/impossible-to-overwrite-host-ip-when-using-custom-logs-integration/298348/1 "2022-02-27T05:05:32Z")
Hi,
I'm trying to get the correct IP for the _host.ip_ property in my logs documents, to be able to utilize all the built in links in kibana but unfortunately I cannot get it to work.
The setup is quite easy. I'm running elastic/kibana v8 and an elastic-agent in a docker container with Custom Logs integration to be able to read log files. These log files uses the following format (truncated):
```auto
{
"timestamp":"2022-02-27T04:41:34.112323Z",
"host":{
"name":"app",
"ip":"192.168.16.6"
}
}
```
The custom logs integration has the following custom configuration:
```auto
json.keys_under_root: true
json.overwrite_keys: true
json.add_error_key: true
json.message_key: message
```
With this configuration I expect _json.overwrite\_keys: true_ to make sure that the _host.ip_ that is automatically added by the elastic-agent is overwritten by the _host.ip_ in the log message, but unfortunately that is not the case and the _host.ip_ in the document is still the IP of the elastic-agent container, not what's in the log file.
I've also tried using the _drop\_fields_ and _rename_ processors to try and rename _host.address_ to _host.ip_ but it also always fails.
Anyone who knows if it is even possible to overwrite the _host.ip_ when running filebeat/Custom Logs integration? Any tips are greatly appreciated
---
### Author:  [@Twyzz](https://discuss.elastic.co/u/Twyzz)
#### Post date: [February 27, 2022, 5:17am UTC](https://discuss.elastic.co/t/impossible-to-overwrite-host-ip-when-using-custom-logs-integration/298348/2 "2022-02-27T05:17:18Z")
I've managed to get it to work using an ingest pipeline, but it feels a bit strange when I think the normal configuration should work. This also requires you to use _host.address_ in the log file instead of _host.ip_ and that is something I want to try and avoid.
```auto
[
{
"remove": {
"field": "host.ip",
"ignore_missing": true
}
},
{
"rename": {
"field": "host.address",
"target_field": "host.ip",
"ignore_missing": true
}
}
]
```
---
### Author:  [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [February 28, 2022, 8:53am UTC](https://discuss.elastic.co/t/impossible-to-overwrite-host-ip-when-using-custom-logs-integration/298348/3 "2022-02-28T08:53:51Z")
Hi @Twyzz !
I think this is happening because `host.ip` of Agent is added at a later step most probably by the `add_host_metadata` processor which is enabled by default. If that's the case I think that a better experience would be for the processor to add host related metadata only if those are not there already. Having said this, please feel free to open Github issue for this so as to have the team look into it.
Thank you!
---
### Author:  [@Twyzz](https://discuss.elastic.co/u/Twyzz)
#### Post date: [February 28, 2022, 2:38pm UTC](https://discuss.elastic.co/t/impossible-to-overwrite-host-ip-when-using-custom-logs-integration/298348/4 "2022-02-28T14:38:19Z")
Hi @ChrsMark
Thanks for the fast reply. I guessed the processor was added automatically (_Couldn't find any documentation on this_) so I tried to disable it, but it kept adding the metadata.
I'm not entirely sure when the json is decoded in filebeat, but my guess is that it either happens before the processors are executed or by a default _decode\_json\_fields_ processor. It might be that the processors are executed in a _decode\_json\_fields_ \> _add\_host\_metadata_ order, and thus _add\_host\_metadata_ overwrites the data.
I'll play around with it a bit more to see if maybe a manual configuration of the processors (_add\_host\_metadata \> decode\_json\_fields_) might work, and I'll open an issue if I feel something is off with the processors.
This is the processor config I used before to try and disable the host processor earlier:
```auto
- add_host_metadata:
netinfo.enabled: false
```
---
### Author:  [@Twyzz](https://discuss.elastic.co/u/Twyzz)
#### Post date: [February 28, 2022, 3:25pm UTC](https://discuss.elastic.co/t/impossible-to-overwrite-host-ip-when-using-custom-logs-integration/298348/5 "2022-02-28T15:25:01Z")
Hi again @ChrsMark
I managed to find a configuration that I missed before when digging through the filebeat.yml configuration in the github repo.
The host information is automatically added unless you tag the document with "forwarded" as seen here:
```auto
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
```
So the solution is to just add the _add\_tags_ processor as seen below:
```auto
- add_tags:
tags: [forwarded]
```
The information is then no longer added, and the information from the log file is kept as expected.
Now my current guess is that these processors are automatically executed after all your own processors, since you cannot modify the information added by the _add\_host\_metadata_ through the _rename/drop\_fields_ processors and that is also most likely why the _json.overwrite\_keys_ has no effect.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 28, 2022, 5:25pm UTC](https://discuss.elastic.co/t/impossible-to-overwrite-host-ip-when-using-custom-logs-integration/298348/6 "2022-03-28T17:25:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.