Logstash to override meta information


(Kathir J) #1

I have a scenario where logs are created in one machine(say machine A) and sent to another machine(Say machine B) where I execute filebeat to push logs to elasticsearch).

When I try to execute filebeat, it gets the host name as machine B name(which is obviously valid though) and the same is getting visualised in Kibana.

What I want to know is, Is there a way that I can override [beat] [name] or [host] [name ] in logstash config so that it sends the host name as machine A?
I tried the below in logstash pipeline but no luck.

mutate { replace => { '[beat][hostname]' => "%{[obj][val]}" } }


(Kathir J) #2

Any reply would be highly appreciated.


(Lewis Barclay) #3

What you are trying to do should work:

mutate { replace => { "[beat][hostname]" => "machine_A" } }