# Viewing hostname instead of ip
**URL:** https://discuss.elastic.co/t/viewing-hostname-instead-of-ip/189023
**Category:** Logstash
**Created:** [July 5, 2019, 7:05am UTC](https://discuss.elastic.co/t/viewing-hostname-instead-of-ip/189023 "2019-07-05T07:05:46Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@JohnM](https://discuss.elastic.co/u/JohnM)
#### Post date: [July 5, 2019, 7:05am UTC](https://discuss.elastic.co/t/viewing-hostname-instead-of-ip/189023/1 "2019-07-05T07:05:46Z")
LOGSTASH 7.2
ES 7.2
I am receiving simple Linux syslog.
In logstash node input filter, I have;
mutate {
add\_field =\> { "syslog\_host" =\> "%{host}" }
}
dns {
reverse =\> ["host"]
action =\> "replace"
}
but in Kibana host field is always ip address, and syslog\_host filed added is also ip address.
How can you replace with hostname?
nslookup won't show reverse dns for our internal servers so that is why it doesn't resolve I guess.
All syslog message field have hostname so is there any ways to retrieve a hostname and show on Kibana field?
Thanks for your help in advance.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 5, 2019, 3:42pm UTC](https://discuss.elastic.co/t/viewing-hostname-instead-of-ip/189023/2 "2019-07-05T15:42:53Z")
The dns filter comes after the mutate, so even if the lookup worked it would not affect the value of [syslog\_host].
If you want help parsing the hostname out of the message field then you need to show us what the message field looks like.
---
### Author:  [@JohnM](https://discuss.elastic.co/u/JohnM)
#### Post date: [July 8, 2019, 10:55pm UTC](https://discuss.elastic.co/t/viewing-hostname-instead-of-ip/189023/3 "2019-07-08T22:55:03Z")
Thanks Badger for your reply.
the message field is something like this.
\<78\>Jul 9 08:52:01 pbx1003 crontab[16499]: (asterisk) LIST (asterisk)
I want to retrieve hostname pbx1003 out of the message field.
Thanks in advance.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 8, 2019, 11:08pm UTC](https://discuss.elastic.co/t/viewing-hostname-instead-of-ip/189023/4 "2019-07-08T23:08:20Z")
> [@JohnM](#):
>
> \<78\>Jul 9 08:52:01 pbx1003 crontab[16499]: (asterisk) LIST (asterisk)
I would start with something like
```
dissect { mapping => { "message" => "<%{pri}>%{[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{hostname} %{}[%{pid}]:" } }
date { match => ["[@metadata][ts]", "MMM dd HH:mm:ss" ] }
```
---
### Author:  [@JohnM](https://discuss.elastic.co/u/JohnM)
#### Post date: [July 9, 2019, 2:14am UTC](https://discuss.elastic.co/t/viewing-hostname-instead-of-ip/189023/6 "2019-07-09T02:14:39Z")
Thanks Badger,
It works great.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 6, 2019, 2:29am UTC](https://discuss.elastic.co/t/viewing-hostname-instead-of-ip/189023/7 "2019-08-06T02:29:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.