# Not able to add host name to metric filter plugin output
**URL:** https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554
**Category:** Logstash
**Created:** [April 8, 2021, 6:55am UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554 "2021-04-08T06:55:50Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [April 8, 2021, 6:55am UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554/1 "2021-04-08T06:55:51Z")
Hi,
I wanted to see how rate at which the clients were sending logs to logstash. I wanted to use the metric filter plugin. And it is working. Except one thing. Here is the conf:
```
input
{
http
{
port => 9999
codec => json
id => "demo"
type => "counted"
tags => "http"
}
}
filter
{
split
{
field => "events"
}
metrics
{
meter => "events"
add_tag => "metric"
add_field => { "hostname" => "%{host}"}
}
}
output
{
if "metric" in [tags]
{
stdout
{
codec => line
{
format => "host:%{hostname}, count_9999: %{[events][count]}, rate_1m: %{[events][rate_1m]}"
}
}
}
else
{
elasticsearch
{
hosts => "http://starkindustries:9455"
ilm_enabled => "true"
ilm_rollover_alias => "test"
ilm_pattern => "000001"
ilm_policy => "test_policy"
user => 'tony'
password => 'pepper'
}
}
}
```
I am getting output like:
`host:%{host}, count_9999: 17, rate_1m: 3.128151`
I think I am missing something here.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 8, 2021, 3:52pm UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554/2 "2021-04-08T15:52:40Z")
> [@pk.241011](#):
>
> `add_field => { "hostname" => "%{host}"}`
The metrics filter generates a new event. It does not have any fields that can be sprintf'd. This is a [known issue](https://github.com/logstash-plugins/logstash-filter-metrics/issues/49).
---
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [April 8, 2021, 11:19pm UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554/3 "2021-04-08T23:19:52Z")
Do we have any workarounds? It will be super useful as I see some of the client machines lagging compared to others.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 8, 2021, 11:48pm UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554/4 "2021-04-08T23:48:09Z")
If you want per-host meters then use `meter => "events_%{host}"`
---
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [April 9, 2021, 12:11am UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554/5 "2021-04-09T00:11:13Z")
If I use
`meter => "events_%{host}"`
then how will my format string look like?
`format => "host:%{hostname}, count_9999: %{[events][count]}, rate_1m: %{[events][rate_1m]}"` did not work
and
`format => "host:%{hostname}, count_9999: %{[events_%{host}][count]}, rate_1m: %{[events_%{host}][rate_1m]}"`
gave me compilation errors.
I think I am missing some formatting here.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 9, 2021, 12:26am UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554/6 "2021-04-09T00:26:35Z")
The documentation covers this.
> For a `meter => "thing"` you will receive the following fields:
>
> - "[thing][count]" - the total count of events
etc. If you use meter =\> "events\_%{host}" for an event which has the [host] field set to "foo" you will get [events\_foo][count] etc. If the event has [host] "bar" you will get [events\_bar][count] etc. metrics
---
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [April 9, 2021, 12:35am UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554/7 "2021-04-09T00:35:23Z")
I am a bit lost here. Does this mean that I will have to hard code the expected event name in the format string? If so that will not solve the issue for me.
I will do some experiments and come back.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 9, 2021, 12:57am UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554/8 "2021-04-09T00:57:02Z")
You might want to explain why you are using that format string. Why not just use json\_lines?
If you absolutely must have a [host] field then you could do something like this in your filter section after the metrics filter.
```
if "metric" in [tags]
ruby {
code => '
event.to_hash.each { |k, v|
matchdata = k.match(/events_([\w\.]+)/)
if matchdata
event.set("events", v)
event.set("host", matchdata[0])
event.remove(k) # Not actually needed if your format does not reference [events_foo]
end
}
'
}
}
```
I have not tested that, but it shows the general idea.
If `[\w\.]+` is too simple to match your host names you could get fancier, all the way up to the pattern grok uses
```
\b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)
```
---
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [April 9, 2021, 2:42am UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554/9 "2021-04-09T02:42:41Z")
Thanks a lot for this. This solves my problem. 😀
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 7, 2021, 2:42am UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554/10 "2021-05-07T02:42:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.