[solved] Host values differ between plugins on the same host

Elastic Stack Logstash
3

Example syslog event:

Created with logger -p user.info "test message"

{
        "severity" => 6,
        "@timestamp" => 2017-10-11T00:20:10.000Z,
        "@version" => "1",
        "host" => "204.89.253.53",
        "program" => "jratliff",
        "message" => "test message\n",
        "priority" => 14,
        "logsource" => "piglet",
        "facility" => 1,
        "severity_label" => "Informational",
        "timestamp" => "Oct 10 20:20:10",
        "facility_label" => "user-level"
}

Logstash Configuration:

input {
    syslog {
        port => 8514
    }
}
output {
    elasticsearch {
        hosts => [ "localhost:9200" ]
    }
}

The syslog event comes from rsyslog on a debian box and is forwarded to rsyslog on the server which runs logstash. That rsyslog then forwards it to logstash. I did this to allow for an SSH tunnel between the two servers to encrypt the traffic. When I went through the tunnel direct to logstash, it thought the host was localhost. Now it knows the host by IP, and the logsource has the hostname, but the host field in syslog is different from the host field in the apache logs, which makes it harder to search for events from the server. I'd like all events from the same server to have the same host name.

Thanks.