I have configured Logstash to receive the syslog message from the networking devices. The dnsmasq and static host-file are used to translate the IP address to hostname. The system is working for few months.
I have changed the hostname of a IP in the host-file and restarted the dnsmasq recently . The nslookup can output the updated hostname. But in the Kibana dashboard, I found the system still using the old hostname .
Could you tell me how to update the hostname field for the specific IP ?
Here is the logstash configuration for the syslog.
input {
udp{
type => syslog
port => 5140
tags => []
}
}
mutate {
add_field => { "hostname" => "%{host}" }
}
dns {
action => "replace"
reverse => [ "hostname" ]
#add_tag => [ "dns_lookup" ]
}