So I recently changed from a TCP to a HTTP listener on logstash. I use Nxlog to transform my logs to Json and send it to a http listener on logstash with the codec json. One of my fields is simply 'host', which the hostname of the device sending it. After switching to http the 'host' field is getting overwritten with the IP address of the device sending the logs. To check if it was issue with Nxlog I wrote a webserver in python that logged all post transactions to file. Nxlog is definitely still sending the Host field with the correct data. Once it hits logstash it's definitely overwriting it. Any idea why this is happening and how to stop it?