Logstash Http Input overwriting field

Elastic Stack Logstash
1

So I recently changed from a TCP to a HTTP listener on logstash. I use Nxlog to transform my logs to Json and send it to a http listener on logstash with the codec json. One of my fields is simply 'host', which the hostname of the device sending it. After switching to http the 'host' field is getting overwritten with the IP address of the device sending the logs. To check if it was issue with Nxlog I wrote a webserver in python that logged all post transactions to file. Nxlog is definitely still sending the Host field with the correct data. Once it hits logstash it's definitely overwriting it. Any idea why this is happening and how to stop it?

Thanks.

2

Known bug:

3

Thanks. I literally just figured this out after going through the source and was going to post on Git. Clearly you've beat me to it

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.