Currently Our config file 000-grok.conf file has below content:
filter {
mutate {
# squash multiple whitespace
gsub => [ "message", "{2,}"," " ]
# ditch the dashes
gsub => [ "message", "{5}.*{50,}\n","" ]
# remove newlines
gsub => [ "message", "\n", " "]
}
grok {
match => [ "message", "%{DATE:date} %{TIME:time} %{DATA:halfday} -" ]
}
if [halfday] =~ /[AP]M/ {
mutate { add_field => [ "ts" , "%{date} %{time} %{halfday}" ] }
} else {
mutate { add_field => [ "ts" , "%{date} %{time}" ] }
}
grok {
match => [ "message", "%{DATE:date} %{TIME:time} %{DATA:halfday }- Process(%{DATA:process}) User(%{WORD:usrName}) Program(%{WORD:program})\s+Host(%{DATA:hostname}) Installation(%{WORD:installation})\s+VRMF(%{DATA:vrmf})( QMgr(%{WORD:qmName}))?\s+%{DATA:errCode}: %{DATA:errDesc}\s+EXPLANATION: %{DATA:explanation}\s+ACTION: %{DATA:action}" ]
}
if [ts] =~ /date/ {
drop { }
}
date {
match => [ "ts", "MM/dd/yyyy hh:mm:ss aa", "MM/dd/yy hh:mm:ss" ]
target => "@timestamp"
}
}
#############################
We are getting the log out put like below 
LEEF:1.0|IBM|MQ|8.0.0.7|POSZ0R|usrName=mqm hostname=nl000917 qmName=BLNPQ errDesc=Channel 'BLNPQ.IQ' to host 'nl00001 (98.9024.56)' ended abnormally.
We want the out put to show 'identHostName' instead of hostaname.
So in which files we need to do changes and what changes we can do for the out put to get identHostName' instead of hostaname ?
We have 99-output.conf file has below content:
output {
if "_qradar" in [tags] {
stdout {
codec => leef {
vendor => "IBM"
product => "MQ"
version => "%{vrmf}"
syslogheader => false
eventid => "%{errCode}"
fields => [ "usrName", "hostname", "qmName", "errDesc" ]
}
}
syslog {
host => "nl09621"
port => 514
sourcehost => "%{hostname}"
codec => leef {
vendor => "IBM"
product => "MQ"
version => "%{vrmf}"
syslogheader => false
eventid => "%{errCode}"
fields => [ "usrName", "hostname", "qmName", "errDesc" ]
}
}
}
}