I'm building an offline log parser using logstash, ES and Kibana. In this scenario the logs are provided in a zip from servers. They are placed in a volume mounted into the logstash container, then pushed into ES and viewed from Kibana.
What this means is that the original server that generated the logs is not the server sending the events to ES.
What I wondered is how can I get logstash to parse the hostname from the offline logs, and then apply this to all events?
I actually don't think this would be possible. I suspect logstash streams lines from the log file hence, if the hostname appeared in line 100, it would not be possible to go back and update the host value on preceding events.
Another idea which could work outside of logstash would be preprocessing the offline logs for the hostname. This raises the slight different question of how to add this externally parsed value into logstash?