Otdfbt

Is openssl rand command cryptographically secure?

Does silver oxide react with hydrogen sulfide?

Is multiple magic items in one inherently imbalanced?

Printing attributes of selection in ArcPy?

Relating to the President and obstruction, were Mueller's conclusions preordained?

The test team as an enemy of development? And how can this be avoided?

In musical terms, what properties are varied by the human voice to produce different words / syllables?

Differences to CCompactSize and CVarInt

Why do early math courses focus on the cross sections of a cone and not on other 3D objects?

What is the difference between CTSS and ITS?

Positioning dot before text in math mode

Monty Hall Problem-Probability Paradox

Can an iPhone 7 be made to function as a NFC Tag?

Why are vacuum tubes still used in amateur radios?

How can a team of shapeshifters communicate?

How to change the tick of the color bar legend to black

Putting class ranking in CV, but against dept guidelines

How much damage would a cupful of neutron star matter do to the Earth?

License to disallow distribution in closed source software, but allow exceptions made by owner?

RSA find public exponent

NERDTreeMenu Remapping

Why is std::move not [[nodiscard]] in C++20?

Tannaka duality for semisimple groups

Google .dev domain strangely redirects to https

How to send ip address to logstash using input as “file”?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

3

1

I am sending few logs to logstash central server using another logstash on client as shipper. The input type is "file". The messages are received fine on server but it does not reflect the IP address of the client. It sends the hostname instead in field "@source_host". Is there anything I can do to get IP as a field? Maybe a filter?

Client conf:

input 
 file 
 format => "plain"
 path => "/var/log/app/test1.txt"
 type => "start"
 


output 
 redis 
 host => "test.example.com"
 data_type => "list"
 key => "logstash"
 

logstash

share|improve this question

asked Feb 26 '13 at 13:13

Aditya PatawariAditya Patawari

916722

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  How goes the battle?
  
  – Dan Garthwaite
  Feb 2 '15 at 2:53
  

  
  
  
  

add a comment | 

3

1

I am sending few logs to logstash central server using another logstash on client as shipper. The input type is "file". The messages are received fine on server but it does not reflect the IP address of the client. It sends the hostname instead in field "@source_host". Is there anything I can do to get IP as a field? Maybe a filter?

Client conf:

input 
 file 
 format => "plain"
 path => "/var/log/app/test1.txt"
 type => "start"
 


output 
 redis 
 host => "test.example.com"
 data_type => "list"
 key => "logstash"
 

logstash

share|improve this question

asked Feb 26 '13 at 13:13

Aditya PatawariAditya Patawari

916722

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  How goes the battle?
  
  – Dan Garthwaite
  Feb 2 '15 at 2:53
  

  
  
  
  

add a comment | 

I am sending few logs to logstash central server using another logstash on client as shipper. The input type is "file". The messages are received fine on server but it does not reflect the IP address of the client. It sends the hostname instead in field "@source_host". Is there anything I can do to get IP as a field? Maybe a filter?

Client conf:

input 
 file 
 format => "plain"
 path => "/var/log/app/test1.txt"
 type => "start"
 


output 
 redis 
 host => "test.example.com"
 data_type => "list"
 key => "logstash"
 

logstash

share|improve this question

asked Feb 26 '13 at 13:13

Aditya PatawariAditya Patawari

916722

input 
 file 
 format => "plain"
 path => "/var/log/app/test1.txt"
 type => "start"
 


output 
 redis 
 host => "test.example.com"
 data_type => "list"
 key => "logstash"
 

share|improve this question

asked Feb 26 '13 at 13:13

Aditya PatawariAditya Patawari

916722

share|improve this question

asked Feb 26 '13 at 13:13

Aditya PatawariAditya Patawari

916722

asked Feb 26 '13 at 13:13

Aditya PatawariAditya Patawari

916722

asked Feb 26 '13 at 13:13

Aditya PatawariAditya Patawari

916722

2 Answers
2

active

oldest

votes

0

You can use the 'dns' filter to do a reverse lookup, then use it to set the field.
http://logstash.net/docs/1.2.2/filters/dns

share|improve this answer

answered Oct 23 '13 at 16:20

Dan GarthwaiteDan Garthwaite

2,5411427

add a comment | 

0

If the client IP you want is static, then I would suggest you could replace the content @source_host using the mutate filter

E.g. :

filter 
 mutate 
 replace => ["@source_host","xx.xx.xx.xx"]
 

If you just wanted the IP in a field (rather than in @source_host), you could add it in your input:

input 
 file 
 format => "plain"
 path => "/var/log/app/test1.txt"
 type => "start"
 add_field => ['source_ip','xx.xx.xx.xx']
 

Otherwise, if you really do need to resolve non-static client hostnames, then @Dan Garthwaite's answer is the right one.

share|improve this answer

answered Mar 19 '17 at 10:18

iwaseatenbyagrueiwaseatenbyagrue

3,107718

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f482599%2fhow-to-send-ip-address-to-logstash-using-input-as-file%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

You can use the 'dns' filter to do a reverse lookup, then use it to set the field.
http://logstash.net/docs/1.2.2/filters/dns

share|improve this answer

answered Oct 23 '13 at 16:20

Dan GarthwaiteDan Garthwaite

2,5411427

add a comment | 

0

You can use the 'dns' filter to do a reverse lookup, then use it to set the field.
http://logstash.net/docs/1.2.2/filters/dns

share|improve this answer

answered Oct 23 '13 at 16:20

Dan GarthwaiteDan Garthwaite

2,5411427

add a comment | 

You can use the 'dns' filter to do a reverse lookup, then use it to set the field.
http://logstash.net/docs/1.2.2/filters/dns

share|improve this answer

answered Oct 23 '13 at 16:20

Dan GarthwaiteDan Garthwaite

2,5411427

share|improve this answer

answered Oct 23 '13 at 16:20

Dan GarthwaiteDan Garthwaite

2,5411427

answered Oct 23 '13 at 16:20

Dan GarthwaiteDan Garthwaite

2,5411427

answered Oct 23 '13 at 16:20

Dan GarthwaiteDan Garthwaite

2,5411427

0

If the client IP you want is static, then I would suggest you could replace the content @source_host using the mutate filter

E.g. :

filter 
 mutate 
 replace => ["@source_host","xx.xx.xx.xx"]
 

If you just wanted the IP in a field (rather than in @source_host), you could add it in your input:

input 
 file 
 format => "plain"
 path => "/var/log/app/test1.txt"
 type => "start"
 add_field => ['source_ip','xx.xx.xx.xx']
 

Otherwise, if you really do need to resolve non-static client hostnames, then @Dan Garthwaite's answer is the right one.

share|improve this answer

answered Mar 19 '17 at 10:18

iwaseatenbyagrueiwaseatenbyagrue

3,107718

add a comment | 

0

If the client IP you want is static, then I would suggest you could replace the content @source_host using the mutate filter

E.g. :

filter 
 mutate 
 replace => ["@source_host","xx.xx.xx.xx"]
 

If you just wanted the IP in a field (rather than in @source_host), you could add it in your input:

input 
 file 
 format => "plain"
 path => "/var/log/app/test1.txt"
 type => "start"
 add_field => ['source_ip','xx.xx.xx.xx']
 

Otherwise, if you really do need to resolve non-static client hostnames, then @Dan Garthwaite's answer is the right one.

share|improve this answer

answered Mar 19 '17 at 10:18

iwaseatenbyagrueiwaseatenbyagrue

3,107718

add a comment | 

If the client IP you want is static, then I would suggest you could replace the content @source_host using the mutate filter

E.g. :

filter 
 mutate 
 replace => ["@source_host","xx.xx.xx.xx"]
 

If you just wanted the IP in a field (rather than in @source_host), you could add it in your input:

input 
 file 
 format => "plain"
 path => "/var/log/app/test1.txt"
 type => "start"
 add_field => ['source_ip','xx.xx.xx.xx']
 

Otherwise, if you really do need to resolve non-static client hostnames, then @Dan Garthwaite's answer is the right one.

share|improve this answer

answered Mar 19 '17 at 10:18

iwaseatenbyagrueiwaseatenbyagrue

3,107718

filter 
 mutate 
 replace => ["@source_host","xx.xx.xx.xx"]
 

input 
 file 
 format => "plain"
 path => "/var/log/app/test1.txt"
 type => "start"
 add_field => ['source_ip','xx.xx.xx.xx']
 

share|improve this answer

answered Mar 19 '17 at 10:18

iwaseatenbyagrueiwaseatenbyagrue

3,107718

answered Mar 19 '17 at 10:18

iwaseatenbyagrueiwaseatenbyagrue

3,107718

answered Mar 19 '17 at 10:18

iwaseatenbyagrueiwaseatenbyagrue

3,107718