# Problem with received\_from not expanding

**URL:** <https://discuss.elastic.co/t/problem-with-received-from-not-expanding/45276>\
**Category:** Logstash\
**Created:** [March 23, 2016, 6:53pm UTC](https://discuss.elastic.co/t/problem-with-received-from-not-expanding/45276 "2016-03-23T18:53:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jcurbo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jcurbo/32/8644_2.png) [@jcurbo](https://discuss.elastic.co/u/jcurbo)\
**Post date:** [March 23, 2016, 6:53pm UTC](https://discuss.elastic.co/t/problem-with-received-from-not-expanding/45276/1 "2016-03-23T18:53:22Z")

</div>

I just set up my first ELK cluster and I'm having a strange issue I can't track down.

I have logstash-forwarder running on the ELK host itself (set it up before I knew filebeat was a thing), and I have an external host running filebeat sending syslog messages to my ELK host. In my logstash config I have `received_from` set up in what looks like a fairly standard way:

```
filter {
    if [type] == "syslog" {
        grok {
          match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
          add_field => ["received_at", "%{@timestamp}"]
          add_field => ["received_from", "%{host}"]
        }
        syslog_pri { }
        date {
          match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
        }
    }
}

```

Messages coming from my ELK host itself show up under its hostname in Kibana just fine. However, messages coming from my other host (using filebeat) show up with `%{host}` in the `received_from` field, like they're not getting expanded by (I presume) logstash. This is from logstash's stdout:

```
{
                 "message" => "Mar 23 14:43:19 juno postfix/anvil[2858]: statistics: max cache size 1 at Mar 23 14:33:29",
                "@version" => "1",
              "@timestamp" => "2016-03-23T18:43:19.000Z",
                    "beat" => {
        "hostname" => "juno",
            "name" => "juno"
    },
                   "count" => 1,
                  "fields" => nil,
              "input_type" => "log",
                  "offset" => 170393,
                  "source" => "/var/log/mail.log",
                    "type" => "syslog",
        "syslog_timestamp" => "Mar 23 14:43:19",
         "syslog_hostname" => "juno",
          "syslog_program" => "postfix/anvil",
              "syslog_pid" => "2858",
          "syslog_message" => "statistics: max cache size 1 at Mar 23 14:33:29",
             "received_at" => "2016-03-23T18:43:27.111Z",
           "received_from" => "%{host}",
    "syslog_severity_code" => 5,
    "syslog_facility_code" => 1,
         "syslog_facility" => "user-level",
         "syslog_severity" => "notice"
}

```

I'm using these versions:

- elasticsearch 2.2.1
- kibana 4.4.2
- logstash 2.0.0
- filebeat 1.1.2

All from [elastic.co](http://elastic.co) repositories/sources, on Debian stable.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 23, 2016, 9:02pm UTC](https://discuss.elastic.co/t/problem-with-received-from-not-expanding/45276/2 "2016-03-23T21:02:32Z")

</div>

Logstash doesn't add a `host` field to events received with the beats input. I'm not sure if there's a better way of doing that than having a ruby filter like this (untested):

```nohighlight
filter {
  if not [host] {
    ruby {
      init => "require 'socket'"
      code => "event['host'] = Socket.gethostname"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![jcurbo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jcurbo/32/8644_2.png) [@jcurbo](https://discuss.elastic.co/u/jcurbo)\
**Post date:** [March 23, 2016, 11:44pm UTC](https://discuss.elastic.co/t/problem-with-received-from-not-expanding/45276/3 "2016-03-23T23:44:32Z")

</div>

Thanks, that is very helpful! I spent hours searching trying to figure out if I did anything wrong, but of course I went back just now and searched some more and came across this Github issue:

> <https://github.com/logstash-plugins/logstash-input-beats/issues/25>

I also figured out I somehow installed logstash 2.0 instead of 2.2. Everything seems to be working now.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 24, 2016, 4:32am UTC](https://discuss.elastic.co/t/problem-with-received-from-not-expanding/45276/4 "2016-03-24T04:32:49Z")

</div>

Sorry, I misread your question and thought you wanted the name of the _receiving host_. Yeah, if you want the origin host then you should definitely use the value that comes from `beat.hostname` or if that value is already put into `host`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/problem-with-received-from-not-expanding/45276/5 "2017-07-06T05:05:37Z")

</div>

Closed on July 6, 2017, 5:05am UTC