Logstash shipper reports hostname as localhost

Elastic Stack Logstash
1

Hi,

I have a set of configuration files I'm using to monitor Tomcat. I use these on various servers but when I recently deployed these to a new server I noticed that the "host" field appears as "localhost" when I view the data using Kibana. The host field is populated correctly on other servers using the same configuration.

If I run hostname on the server it returns the correct hostname. Does anybody know how Logstash resolves the hostname and/or why it resolves to localhost rather than the FQDN?

Thanks!

2

Is the host field populated by Logstash? What hostname does

echo foo | /opt/logstash/bin/logstash -e 'input { stdin {} } output { stdout { codec => rubydebug } }'

produce (adjust the Logstash path as necessary, obviously)?

3

Hi Magnus,

Thanks for replying. I just ran the command you suggested and the hostname returned was the correct FQDN:

{
"message" => "foo",
"@version" => "1",
"@timestamp" => "2016-01-08T16:50:10.922Z",
"host" => "ecllapmappp002.ebs.ecomp.com"
}
Logstash startup completed
Logstash shutdown completed

4

Okay, so it seems something's overwriting the real hostname value somewhere.