# Is there anyway I can tag the elasticsearch server name in the field? **URL:** \ **Category:** Logstash\ **Created:** [September 22, 2016, 3:32am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196 "2016-09-22T03:32:59Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![macymin](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@macymin](https://discuss.elastic.co/u/macymin)\ **Post date:** [September 22, 2016, 3:32am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196/1 "2016-09-22T03:32:59Z")
my data flows from source server --\> redis (on elasticsearch server A) --\> elasticsearch (same server as redis run). what i know is logstash can only parse whatever available in the message or path, elasticsearch is not available in the document, for this case, is there any way i can create a field of elasticsearch server name ?? below is an example document "message" =\> "09/22/16: 11:09:31.904: \n RECEIVING INTERNAL message, acitype=0x44440003 antype=32000 size=105\n FROM: LSSDADM100SFCSrv \n TO: LSSDADM100SFCSrv \nfr=LSSDADM100SFCSrv to=LSSDADM100SFCSrv do=sfc chart=FwHostSFC cctxt=LSSDADM100 step=S8 noreply nosyntax\n==================================================", "@version" =\> "1", "@timestamp" =\> "2016-09-22T03:09:32.709Z", "host" =\> "fslautodev001", "path" =\> "/var/mtapps/ashl/logs/AMAT/ProducerGT/LSSDADM100/mq-sLSSDADM100.log.th", "type" =\> "Auto::Host::mqs", "tags" =\> [ [0] "multiline" ] ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 22, 2016, 5:28am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196/2 "2016-09-22T05:28:10Z")
So where is Logstash running? In your data flow graph I only see the source serve (is that where Logstash runs?), Redis, and Elasticsearch. ---
**Author:** ![macymin](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@macymin](https://discuss.elastic.co/u/macymin)\ **Post date:** [September 22, 2016, 6:11am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196/3 "2016-09-22T06:11:27Z")
i got logstash running on both source and elk server. the one running on source server one ships the log output to redis. another logstash running on elk server do the actual parsing and output to elasticsearch. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 22, 2016, 7:04am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196/4 "2016-09-22T07:04:53Z")
Perhaps you can read the HOSTNAME environment variable? See [https://www.elastic.co/guide/en/logstash/current/environment-variables.html](https://www.elastic.co/guide/en/logstash/current/environment-variables.html). Otherwise you can obtain the hostname via a ruby filter (try googling "logstash ruby filter gethostname"). ---
**Author:** ![macymin](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@macymin](https://discuss.elastic.co/u/macymin)\ **Post date:** [September 22, 2016, 8:46am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196/5 "2016-09-22T08:46:27Z")
hi Mag, yeah this is exactly what I want, but just now i did a quick try, seems it can not get the data. btw i use logstash 2.3.2 ![](https://us1.discourse-cdn.com/elastic/original/2X/a/a7ce69d6c65a09c05f030fc3c73eb3603f0fe1ff.png) logstash config: input { redis { host =\> "localhost" #type =\> "redis-input" data\_type =\> "list" key =\> "HostLog" } } filter { grok { match =\> {"path" =\> "/var/mtapps/ashl/logs/(?[A-Za-z0-9]+)/(?[A-Za-z0-9\_]+)/(?[A-Z0-9]+)/%{GREEDYDATA}"} } grok { match =\> { "message" =\> "^(.)?(?%{DATE\_US}: %{TIME}):%{GREEDYDATA}"} } mutate { add\_field =\> { "elkserver" =\> "${HOSTNAME}" } } if ([type] == "Auto::Host::mqs") { kv{ field\_split =\> " \r\n" include\_keys =\> ["fr", "to", "SF", "do", "command", "reply", "SchedState", "SubState", "MESCode", "MESErr", "BatchId", "CEID", "SubEquipId", "ProcessName", "EventName"] } } } output { elasticsearch { hosts =\> ["fslelk02"] index =\> "host-%{+YYYY.MM.dd}" workers =\> 4 } } And i check the environment variable do have values: HOSTNAME=fslelk02 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 22, 2016, 8:54am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196/6 "2016-09-22T08:54:36Z")
And did you start Logstash with `--allow-env`? ---
**Author:** ![macymin](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@macymin](https://discuss.elastic.co/u/macymin)\ **Post date:** [September 22, 2016, 9:06am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196/7 "2016-09-22T09:06:09Z")
tried to run in cmd line /opt/logstash/bin/logstash -f indexer\_auto\_host.conf --allow-env and it can get the correct value now. however normally we run logstash as daemon, is there any way to config this in .conf or startup file? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 22, 2016, 10:39am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196/8 "2016-09-22T10:39:00Z")
There's an environment variable you can set in /etc/default/logstash (Debian) or /etc/sysconfig/logstash (RPM) that contains extra options to pass to Logstash. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:37am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196/9 "2017-07-06T04:37:23Z")