# Logstash host field set as docker bridge network gateway **URL:** \ **Category:** Logstash\ **Tags:** docker\ **Created:** [August 22, 2019, 7:13pm UTC](https://discuss.elastic.co/t/logstash-host-field-set-as-docker-bridge-network-gateway/196395 "2019-08-22T19:13:18Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![dcmott86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dcmott86/32/52848_2.png) [@dcmott86](https://discuss.elastic.co/u/dcmott86)\ **Post date:** [August 22, 2019, 7:13pm UTC](https://discuss.elastic.co/t/logstash-host-field-set-as-docker-bridge-network-gateway/196395/1 "2019-08-22T19:13:18Z")
Running logstash 7.3.0 as a docker container. I have a UDP input receiving messages from from some Cisco ASA's and the host field is populating with the docker bridge network gateway address vs the firewall's IP. Ruby debug output shows: **"host" =\> "172.18.0.1",** I've been searching trying to see if anyone else has encountered this before. I can't seem to replicate the issue in my lab. I've also done some sniffing and can see the traffic coming in to the host machine with the proper source IP. How exactly does the host field get populated in logstash? Any suggestions are greatly appreciated! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 22, 2019, 8:15pm UTC](https://discuss.elastic.co/t/logstash-host-field-set-as-docker-bridge-network-gateway/196395/2 "2019-08-22T20:15:14Z")
> [@dcmott86](#): > > How exactly does the host field get populated in logstash? In a udp input it's done like [this](https://github.com/logstash-plugins/logstash-input-udp/blob/9f6e64f1fa970021e22b087374bfa97be8eaf17b/lib/logstash/inputs/udp.rb#L42), so you need to set that option to something else. ---
**Author:** ![dcmott86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dcmott86/32/52848_2.png) [@dcmott86](https://discuss.elastic.co/u/dcmott86)\ **Post date:** [August 22, 2019, 8:51pm UTC](https://discuss.elastic.co/t/logstash-host-field-set-as-docker-bridge-network-gateway/196395/3 "2019-08-22T20:51:23Z")
Hi Badger, Thanks for responding. Is that string being pulled from the UDP packet header? I'm guessing that docker is mutating that header, I'm running a quick sniff to confirm. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 22, 2019, 9:36pm UTC](https://discuss.elastic.co/t/logstash-host-field-set-as-docker-bridge-network-gateway/196395/4 "2019-08-22T21:36:33Z")
It's populated from the sender\_addrinfo that recvfrom\_nonblock returns. I would expect that to be whatever is in the UDP header. ---
**Author:** ![dcmott86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dcmott86/32/52848_2.png) [@dcmott86](https://discuss.elastic.co/u/dcmott86)\ **Post date:** [August 23, 2019, 3:03pm UTC](https://discuss.elastic.co/t/logstash-host-field-set-as-docker-bridge-network-gateway/196395/5 "2019-08-23T15:03:53Z")
I can't replicate this issue in a lab. I just updated to 7.3.1 and swapped out to different hardware. I'm going to try running logstash as a service on the host box as opposed to a docker container. I expect that to resolve the problem. ---
**Author:** ![dcmott86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dcmott86/32/52848_2.png) [@dcmott86](https://discuss.elastic.co/u/dcmott86)\ **Post date:** [August 23, 2019, 6:31pm UTC](https://discuss.elastic.co/t/logstash-host-field-set-as-docker-bridge-network-gateway/196395/6 "2019-08-23T18:31:07Z")
I installed Logstash as a service which resolved this issue. I'd prefer running Logstash as a container but this will work fine for now. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 20, 2019, 6:31pm UTC](https://discuss.elastic.co/t/logstash-host-field-set-as-docker-bridge-network-gateway/196395/7 "2019-09-20T18:31:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.