# Logstash shipper reports hostname as localhost

**URL:** <https://discuss.elastic.co/t/logstash-shipper-reports-hostname-as-localhost/38648>\
**Category:** Logstash\
**Created:** [January 7, 2016, 4:37pm UTC](https://discuss.elastic.co/t/logstash-shipper-reports-hostname-as-localhost/38648 "2016-01-07T16:37:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mburlington](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@mburlington](https://discuss.elastic.co/u/mburlington)\
**Post date:** [January 7, 2016, 4:37pm UTC](https://discuss.elastic.co/t/logstash-shipper-reports-hostname-as-localhost/38648/1 "2016-01-07T16:37:11Z")

</div>

Hi,

I have a set of configuration files I'm using to monitor Tomcat. I use these on various servers but when I recently deployed these to a new server I noticed that the "host" field appears as "localhost" when I view the data using Kibana. The host field is populated correctly on other servers using the same configuration.

If I run hostname on the server it returns the correct hostname. Does anybody know how Logstash resolves the hostname and/or why it resolves to localhost rather than the FQDN?

Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 7, 2016, 6:20pm UTC](https://discuss.elastic.co/t/logstash-shipper-reports-hostname-as-localhost/38648/2 "2016-01-07T18:20:06Z")

</div>

Is the `host` field populated by Logstash? What hostname does

```
echo foo | /opt/logstash/bin/logstash -e 'input { stdin {} } output { stdout { codec => rubydebug } }'

```

produce (adjust the Logstash path as necessary, obviously)?

---

<div class="post-metadata">

**Author:** ![mburlington](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@mburlington](https://discuss.elastic.co/u/mburlington)\
**Post date:** [January 8, 2016, 4:53pm UTC](https://discuss.elastic.co/t/logstash-shipper-reports-hostname-as-localhost/38648/3 "2016-01-08T16:53:58Z")

</div>

Hi Magnus,

Thanks for replying. I just ran the command you suggested and the hostname returned was the correct FQDN:

{  
"message" =\> "foo",  
"@version" =\> "1",  
"@timestamp" =\> "2016-01-08T16:50:10.922Z",  
"host" =\> "[ecllapmappp002.ebs.ecomp.com](http://ecllapmappp002.ebs.ecomp.com)"  
}  
Logstash startup completed  
Logstash shutdown completed

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 8, 2016, 6:06pm UTC](https://discuss.elastic.co/t/logstash-shipper-reports-hostname-as-localhost/38648/4 "2016-01-08T18:06:15Z")

</div>

Okay, so it seems something's overwriting the real hostname value somewhere.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:16am UTC](https://discuss.elastic.co/t/logstash-shipper-reports-hostname-as-localhost/38648/5 "2017-07-06T05:16:18Z")

</div>