# Logstash Http Input overwriting field

**URL:** <https://discuss.elastic.co/t/logstash-http-input-overwriting-field/109065>\
**Category:** Logstash\
**Created:** [November 24, 2017, 5:04pm UTC](https://discuss.elastic.co/t/logstash-http-input-overwriting-field/109065 "2017-11-24T17:04:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dj50x](https://avatars.discourse-cdn.com/v4/letter/d/5f8ce5/32.png) [@dj50x](https://discuss.elastic.co/u/dj50x)\
**Post date:** [November 24, 2017, 5:04pm UTC](https://discuss.elastic.co/t/logstash-http-input-overwriting-field/109065/1 "2017-11-24T17:04:22Z")

</div>

So I recently changed from a TCP to a HTTP listener on logstash. I use Nxlog to transform my logs to Json and send it to a http listener on logstash with the codec json. One of my fields is simply 'host', which the hostname of the device sending it. After switching to http the 'host' field is getting overwritten with the IP address of the device sending the logs. To check if it was issue with Nxlog I wrote a webserver in python that logged all post transactions to file. Nxlog is definitely still sending the Host field with the correct data. Once it hits logstash it's definitely overwriting it. Any idea why this is happening and how to stop it?

Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 24, 2017, 7:12pm UTC](https://discuss.elastic.co/t/logstash-http-input-overwriting-field/109065/2 "2017-11-24T19:12:31Z")

</div>

Known bug:

> <https://github.com/logstash-plugins/logstash-input-http/issues/61>

---

<div class="post-metadata">

**Author:** ![dj50x](https://avatars.discourse-cdn.com/v4/letter/d/5f8ce5/32.png) [@dj50x](https://discuss.elastic.co/u/dj50x)\
**Post date:** [November 24, 2017, 8:19pm UTC](https://discuss.elastic.co/t/logstash-http-input-overwriting-field/109065/3 "2017-11-24T20:19:10Z")

</div>

Thanks. I literally just figured this out after going through the source and was going to post on Git. Clearly you've beat me to it

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 22, 2017, 8:19pm UTC](https://discuss.elastic.co/t/logstash-http-input-overwriting-field/109065/4 "2017-12-22T20:19:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.