I am sending few logs to logstash central server using another logstash on client as shipper. The input type is "file". The messages are received fine on server but it does not reflect the IP address of the client. It sends the hostname instead in field "@source_host". Is there anything I can do to get IP as a field? Maybe a filter?
Client conf:
input {
file {
format => "plain"
path => "/var/log/app/test1.txt"
type => "start"
}
}
output {
redis {
host => "test.example.com"
data_type => "list"
key => "logstash"
}
}
Best Answer
You can use the 'dns' filter to do a reverse lookup, then use it to set the field. http://logstash.net/docs/1.2.2/filters/dns