Why doesn't add_tag => ["${HOSTNAME}"] work?

Elastic Stack Logstash
19

@magnusbaeck, With the help of elastic support, we figured this out. Turns out it was 2 easy changes to get it working. I am not saying that it was easy figuring this out, because it wasn't easy!

mutate {
  add_tag => ["${HOSTNAME}"]
}
  • Add xpack.management.pipeline.id: to logstash.yml
  • Create file, /etc/sysconfig/logstash, (chmod 600) and add these 2 lines
    • HOSTNAME=ThisHostName
    • LOGSTASH_KEYSTORE_PASS=password

Thanks again for your help!