Macros available for identifying the logstash host

Elastic Stack Logstash
1

We have several logstash hosts that have the same config, and we like to add a field upon ingestion via the input to help us show which logstash host ingested each line. It helps us to do some graphing, mapping, and checking.

Right now, we have to hard set this as a field within the input (a la add_field => { "logstash_host" => "logstash2" }

Is there a way to do this with some sort of macro so that we can use the same input file across all of our logstash nodes? Would be nice if we could do something like "%{IP}" or "%{LAST_OCTET}" or something like that.

2

You can reference environment variables in configuration files: https://www.elastic.co/guide/en/logstash/current/environment-variables.html

Alternatively, if you're using a tool like Ansible, Chef, or Puppet to push your configuration (which you should) you can easily make a template out of the configuration file and have the tool in question insert the hostname.

3

Gah!!! Magnus!! I forgot about this feature. Thank you so much for reminding me of it. This will allow us to do exactly what we want to do.

Thank you.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.