# Logstash importing hostname incorrectly
**URL:** https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496
**Category:** Logstash
**Created:** [March 26, 2021, 1:25pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496 "2021-03-26T13:25:02Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@ASA01](https://discuss.elastic.co/u/ASA01)
#### Post date: [March 26, 2021, 1:25pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496/1 "2021-03-26T13:25:02Z")
Running across something I don't understand after building a new stack with the latest release of Logstash (7.11.1). It appears to be entering the hostname wrong or I understand it wrong. The system hostname is cmscd however, in ES I am seeing
I looked in the environ for logstash and see HOSTNAME=cmscd. I am not sure where the duplicate names are coming from. Nothing really crazy in my output section.
```auto
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "ech-%{+YYYY.MM.dd}"
document_id => "%{acd}_%{callid}_%{segment}_%{ucid}"
manage_template => false
user => "${ES_USER}"
password => "${ES_PWD}"
}
stdout { codec => rubydebug }
}
```
Just trying to understand why I am getting both host and hostname and why hostname is repeated.
Thanks for your assistance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 26, 2021, 4:16pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496/2 "2021-03-26T16:16:44Z")
I suspect hostname is an array, containing three copies of host. That would happen if you did
```
mutate { add_field => { "hostname" => "%{host}" } }
mutate { add_field => { "hostname" => "%{host}" } }
mutate { add_field => { "hostname" => "%{host}" } }
```
---
### Author:  [@ASA01](https://discuss.elastic.co/u/ASA01)
#### Post date: [March 26, 2021, 5:24pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496/3 "2021-03-26T17:24:38Z")
here is the entire conf. I don't have hostname in it at all.
```auto
input {
file {
path => "/home/ech/chr*"
start_position => "beginning"
file_completed_action => "delete"
sincedb_path => "/dev/null"
mode => "read"
}
}
filter {
csv {
separator => "|"
skip_header => true
autodetect_column_names => true
skip_empty_rows => true
}
date {
match => ["segstart", "yyyy-MM-dd HH:mm:ss"]
}
date {
match => ["segstart", "yyyy-MM-dd HH:mm:ss"]
target => "segstart"
}
date {
match => ["segstop", "yyyy-MM-dd HH:mm:ss"]
target => "segstop"
}
date {
match => ["segstart_utc", "yyyy-MM-dd HH:mm:ss"]
target => "segstart_utc"
}
date {
match => ["segstop_utc", "yyyy-MM-dd HH:mm:ss"]
target => "segstop_utc"
}
translate {
field => "disposition"
destination => "calldisposition"
fallback => "unknown"
dictionary => {
"1" => "Connected"
"2" => "Answered"
"3" => "Abandoned"
"4" => "Interflowed"
"5" => "Forced Busy"
"6" => "Forced Disconnect"
"7" => "Other"
"8" => "ICR Pulled"
}
}
translate {
field => "interruptdel"
destination => "interrupt"
fallback => "unknown"
dictionary => {
"0" => "Not Applicable"
"1" => "Auto in Interrupt"
"2" => "Manual in Interrupt"
"3" => "Notify Interrupt"
}
}
if [dispsplit] == "-1" {
mutate {
replace => ["dispsplit","0"]
}
}
if [split1] == "-1" {
mutate {
replace => ["split1","0"]
}
}
if [split2] == "-1" {
mutate {
replace => ["split2","0"]
}
}
if [split3] == "-1" {
mutate {
replace => ["split3","0"]
}
}
mutate {
convert => {"disposition" => "integer"}
convert => {"holdabn" => "integer"}
convert => {"talktime" => "integer"}
convert => {"acwtime" => "integer"}
convert => {"ringtime" => "integer"}
convert => {"dispriority" => "integer"}
convert => {"queuetime" => "integer"}
convert => {"duration" => "integer"}
convert => {"ansholdtime" => "integer"}
convert => {"disptime" => "integer"}
convert => {"netintime" => "integer"}
convert => {"tenant_num" => "integer"}
convert => {"dispsklevel" => "integer"}
convert => {"prefskilllevel" => "integer"}
convert => {"origholdtime" => "integer"}
convert => {"ansreason" => "integer"}
convert => {"consulttime" => "integer"}
convert => {"agentsurplus" => "integer"}
convert => {"cwc1" => "integer"}
convert => {"cwc2" => "integer"}
convert => {"cwc3" => "integer"}
convert => {"cwc4" => "integer"}
convert => {"cwc5" => "integer"}
convert => {"acd" => "integer"}
convert => {"dispsplit" => "integer"}
convert => {"held" => "integer"}
convert => {"split1" => "integer"}
convert => {"split2" => "integer"}
convert => {"split3" => "integer"}
convert => {"dispivector" => "integer"}
convert => {"firstvector" => "integer"}
convert => {"callid" => "integer"}
convert => {"eq_locid" => "integer"}
convert => {"event1" => "integer"}
convert => {"event2" => "integer"}
convert => {"event3" => "integer"}
convert => {"event4" => "integer"}
convert => {"event5" => "integer"}
convert => {"event6" => "integer"}
convert => {"event7" => "integer"}
convert => {"event8" => "integer"}
convert => {"event9" => "integer"}
convert => {"interruptdel" => "integer"}
convert => {"origreason" => "integer"}
convert => {"uui_length" => "integer"}
convert => {"ans_locid" => "integer"}
convert => {"orig_locid" => "integer"}
convert => {"icrpullreason" => "integer"}
convert => {"firstivector" => "integer"}
convert => {"agentskilllevel" => "integer"}
convert => {"obs_locid" => "integer"}
convert => {"tkgrp" => "integer"}
convert => {"segment" => "integer"}
convert => {"uui_len" => "integer"}
convert => {"assist" => "integer"}
convert => {"transferred" => "integer"}
convert => {"malicious" => "integer"}
convert => {"agt_released" => "integer"}
convert => {"conference" => "integer"}
convert => {"da_queued" => "integer"}
convert => {"icrresent" => "integer"}
convert => {"audio" => "integer"}
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "ech-%{+YYYY.MM.dd}"
document_id => "%{acd}_%{callid}_%{segment}_%{ucid}"
manage_template => false
user => "${ES_USER}"
password => "${ES_PWD}"
}
stdout { codec => rubydebug }
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 26, 2021, 6:01pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496/4 "2021-03-26T18:01:56Z")
Does [hostname] show up in the rubydebug output on stdout?
---
### Author:  [@ASA01](https://discuss.elastic.co/u/ASA01)
#### Post date: [March 29, 2021, 1:40pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496/5 "2021-03-29T13:40:18Z")
No it does not.
I get "host" =\> "cmscd", That is it. Nothing for "hostname"
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 29, 2021, 4:38pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496/6 "2021-03-29T16:38:34Z")
OK, so logstash is not adding it. Do you have ingestion pipelines in elasticsearch?
---
### Author:  [@ASA01](https://discuss.elastic.co/u/ASA01)
#### Post date: [March 31, 2021, 9:02pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496/7 "2021-03-31T21:02:39Z")
Sorry for the delay, I do not have any. Could scripted fields that don't have anything to do with the hostname is all.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 28, 2021, 9:02pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496/8 "2021-04-28T21:02:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.