# \[solved\] Host values differ between plugins on the same host

**URL:** <https://discuss.elastic.co/t/solved-host-values-differ-between-plugins-on-the-same-host/103456>\
**Category:** Logstash\
**Created:** [October 11, 2017, 1:02am UTC](https://discuss.elastic.co/t/solved-host-values-differ-between-plugins-on-the-same-host/103456 "2017-10-11T01:02:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jratliff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jratliff/32/52746_2.png) [@jratliff](https://discuss.elastic.co/u/jratliff)\
**Post date:** [October 11, 2017, 1:02am UTC](https://discuss.elastic.co/t/solved-host-values-differ-between-plugins-on-the-same-host/103456/1 "2017-10-11T01:02:36Z")

</div>

I'm trying out Elastic Stack. I setup a filebeat to ship my apache access logs and a syslog input on logstash to get the syslog data from the host.

The logs end up in the right place, but the syslog shows the host as the IP address and the apache logs show the host as the hostname. How can I get the syslog to use the hostname?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 11, 2017, 5:15am UTC](https://discuss.elastic.co/t/solved-host-values-differ-between-plugins-on-the-same-host/103456/2 "2017-10-11T05:15:01Z")

</div>

Please show your configuration and an example syslog event. Copy/paste from Kibana's JSON tab or use a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![jratliff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jratliff/32/52746_2.png) [@jratliff](https://discuss.elastic.co/u/jratliff)\
**Post date:** [October 11, 2017, 12:09pm UTC](https://discuss.elastic.co/t/solved-host-values-differ-between-plugins-on-the-same-host/103456/3 "2017-10-11T12:09:11Z")

</div>

Example syslog event:

Created with logger -p [user.info](http://user.info) "test message"

```
{
        "severity" => 6,
        "@timestamp" => 2017-10-11T00:20:10.000Z,
        "@version" => "1",
        "host" => "204.89.253.53",
        "program" => "jratliff",
        "message" => "test message\n",
        "priority" => 14,
        "logsource" => "piglet",
        "facility" => 1,
        "severity_label" => "Informational",
        "timestamp" => "Oct 10 20:20:10",
        "facility_label" => "user-level"
}

```

Logstash Configuration:

```
input {
    syslog {
        port => 8514
    }
}
output {
    elasticsearch {
        hosts => ["localhost:9200"]
    }
}

```

The syslog event comes from rsyslog on a debian box and is forwarded to rsyslog on the server which runs logstash. That rsyslog then forwards it to logstash. I did this to allow for an SSH tunnel between the two servers to encrypt the traffic. When I went through the tunnel direct to logstash, it thought the host was localhost. Now it knows the host by IP, and the logsource has the hostname, but the host field in syslog is different from the host field in the apache logs, which makes it harder to search for events from the server. I'd like all events from the same server to have the same host name.

Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 11, 2017, 12:20pm UTC](https://discuss.elastic.co/t/solved-host-values-differ-between-plugins-on-the-same-host/103456/4 "2017-10-11T12:20:44Z")

</div>

Why not just rename the `logsource` field `host` with a mutate filter?

---

<div class="post-metadata">

**Author:** ![jratliff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jratliff/32/52746_2.png) [@jratliff](https://discuss.elastic.co/u/jratliff)\
**Post date:** [October 12, 2017, 6:38pm UTC](https://discuss.elastic.co/t/solved-host-values-differ-between-plugins-on-the-same-host/103456/5 "2017-10-12T18:38:05Z")

</div>

That works. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2017, 6:38pm UTC](https://discuss.elastic.co/t/solved-host-values-differ-between-plugins-on-the-same-host/103456/6 "2017-11-09T18:38:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.