Viewing hostname instead of ip

Elastic Stack Logstash
1

LOGSTASH 7.2
ES 7.2

I am receiving simple Linux syslog.

In logstash node input filter, I have;
mutate {
add_field => { "syslog_host" => "%{host}" }
}
dns {
reverse => [ "host" ]
action => "replace"
}
but in Kibana host field is always ip address, and syslog_host filed added is also ip address.
How can you replace with hostname?

nslookup won't show reverse dns for our internal servers so that is why it doesn't resolve I guess.
All syslog message field have hostname so is there any ways to retrieve a hostname and show on Kibana field?

Thanks for your help in advance.

2

The dns filter comes after the mutate, so even if the lookup worked it would not affect the value of [syslog_host].

If you want help parsing the hostname out of the message field then you need to show us what the message field looks like.

3

Thanks Badger for your reply.
the message field is something like this.

<78>Jul 9 08:52:01 pbx1003 crontab[16499]: (asterisk) LIST (asterisk)

I want to retrieve hostname pbx1003 out of the message field.

Thanks in advance.

4

I would start with something like

    dissect { mapping => { "message" => "<%{pri}>%{[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{hostname} %{}[%{pid}]:" } }
    date { match => [ "[@metadata][ts]", "MMM dd HH:mm:ss" ] }
6

Thanks Badger,
It works great.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.