# Logstash Filtering client hostname
**URL:** https://discuss.elastic.co/t/logstash-filtering-client-hostname/195507
**Category:** Logstash
**Created:** [August 16, 2019, 1:58pm UTC](https://discuss.elastic.co/t/logstash-filtering-client-hostname/195507 "2019-08-16T13:58:54Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@candre.dabney](https://discuss.elastic.co/u/candre.dabney)
#### Post date: [August 16, 2019, 1:58pm UTC](https://discuss.elastic.co/t/logstash-filtering-client-hostname/195507/1 "2019-08-16T13:58:54Z")
We have our environment, which is operating off of Centos 7, set up so that client machines forward their syslog data to our elk server.
We'd like to know how we can edit the /etc/logstash/conf.d/10-syslog-filter.conf to add a field where it displays the hostname and/or IP address from which the syslog data was sent from. I've posted the contents of the 10-syslog-filter.conf file. Thank you for your assistance
filter {
mutate {
add\_field =\> { "remote\_ip" =\> "%{[@metadata][ip\_address]}" }
add\_field =\> { "client.hostname" =\> "%{host}" }
}
if [fileset][module] == "system" {
if [fileset][name] == "auth" {
grok {
match =\> { "message" =\> ["%{SYSLOGTIMESTAMP:[system][auth][timestamp]} %{SYSLOGHOST:[system][auth][hostname]} sshd(?:[%{POSINT:[system][auth][pid]}])?: %{DATA:[system][auth][ssh][event]} %{DATA:[system][auth][ssh][method]} for (invalid user )?%{DATA:[system][auth][user]} from %{IPORHOST:[system][auth][ssh][ip]} port %{NUMBER:[system][auth][ssh][port]} ssh2(: %{GREEDYDATA:[system][auth][ssh][signature]})?",
"%{SYSLOGTIMESTAMP:[system][auth][timestamp]} %{SYSLOGHOST:[system][auth][hostname]} sshd(?:[%{POSINT:[system][auth][pid]}])?: %{DATA:[system][auth][ssh][event]} user %{DATA:[system][auth][user]} from %{IPORHOST:[system][auth][ssh][ip]}",
"%{SYSLOGTIMESTAMP:[system][auth][timestamp]} %{SYSLOGHOST:[system][auth][hostname]} sshd(?:[%{POSINT:[system][auth][pid]}])?: Did not receive identification string from %{IPORHOST:[system][auth][ssh][dropped\_ip]}",
"%{SYSLOGTIMESTAMP:[system][auth][timestamp]} %{SYSLOGHOST:[system][auth][hostname]} sudo(?:[%{POSINT:[system][auth][pid]}])?: \s\*%{DATA:[system][auth][user]} : ( %{DATA:[system][auth][sudo][error]} ;)? TTY=%{DATA:[system][auth][sudo][tty]} ; PWD=%{DATA:[system][auth][sudo][pwd]} ; USER=%{DATA:[system][auth][sudo][user]} ; COMMAND=%{GREEDYDATA:[system][auth][sudo][command]}",
"%{SYSLOGTIMESTAMP:[system][auth][timestamp]} %{SYSLOGHOST:[system][auth][hostname]} groupadd(?:[%{POSINT:[system][auth][pid]}])?: new group: name=%{DATA:system.auth.groupadd.name}, GID=%{NUMBER:system.auth.groupadd.gid}",
"%{SYSLOGTIMESTAMP:[system][auth][timestamp]} %{SYSLOGHOST:[system][auth][hostname]} useradd(?:[%{POSINT:[system][auth][pid]}])?: new user: name=%{DATA:[system][auth][user][add][name]}, UID=%{NUMBER:[system][auth][user][add][uid]}, GID=%{NUMBER:[system][auth][user][add][gid]}, home=%{DATA:[system][auth][user][add][home]}, shell=%{DATA:[system][auth][user][add][shell]}$",
"%{SYSLOGTIMESTAMP:[system][auth][timestamp]} %{SYSLOGHOST:[system][auth][hostname]} %{DATA:[system][auth][program]}(?:[%{POSINT:[system][auth][pid]}])?: %{GREEDYMULTILINE:[system][auth][message]}"] }
pattern\_definitions =\> {
"GREEDYMULTILINE"=\> "(.|\n)_"
}
remove\_field =\> "message"
}
date {
match =\> ["[system][auth][timestamp]", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
geoip {
source =\> "[system][auth][ssh][ip]"
target =\> "[system][auth][ssh][geoip]"
}
}
else if [fileset][name] == "syslog" {
grok {
match =\> { "message" =\> ["%{SYSLOGTIMESTAMP:[system][syslog][timestamp]} %{SYSLOGHOST:[system][syslog][hostname]} %{DATA:[system][syslog][program]}(?:[%{POSINT:[system][syslog][pid]}])?: %{GREEDYMULTILINE:[system][syslog][message]}"] }
pattern\_definitions =\> { "GREEDYMULTILINE" =\> "(.|\n)_" }
remove\_field =\> "message"
}
date {
match =\> ["[system][syslog][timestamp]", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 13, 2019, 1:58pm UTC](https://discuss.elastic.co/t/logstash-filtering-client-hostname/195507/2 "2019-09-13T13:58:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.