How to maintain the log source host using logstash

Posted by Ray Rodriguez on Server Fault See other posts from Server Fault or by Ray Rodriguez
Published on 2012-04-13T20:27:13Z Indexed on 2012/11/03 17:06 UTC
Read the original article Hit count: 364

Filed under:

logging

|

syslog

|

rsyslog

|

graylog2

I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter.

In the exmaple the author replaces his @source_host with a string value but I'd like to use the actual value that is parsed from in this case a syslog.

mutate {
  type => loc1
  replace => ["@source_host", "loc1"]
}
mutate {
  type => loc2
 replace => ["@source_host", "loc2"]
}

How do I actually maintain the original source host in my logs?

© Server Fault or respective owner

Related posts about logging

log file is not getting created using JDK logging with Commons-logging

as seen on Stack Overflow - Search for 'Stack Overflow'
When I run the TestJcLLoggingService class log messages are coming to Console but no log file is created, please help me if you know the answer. two source files are pasted below. TestJcLLoggingService.java package com.amadeus.psp.pasd.logging; import org.apache.commons.logging.Log; import org… >>> More
Python: combine logging and wx so that logging stream is redirectet to stdout/stderr frame

as seen on Stack Overflow - Search for 'Stack Overflow'
Here's the thing: I'm trying to combine the logging module with wx.App()'s redirect feature. My intention is to log to a file AND to stderr. But I want stderr/stdout redirected to a separate frame as is the feature of wx.App. My test code: import logging import wx class MyFrame(wx.Frame): … >>> More
Python logging before you run logging.basicConfig?

as seen on Stack Overflow - Search for 'Stack Overflow'
It appears that if you invoke logging.info() BEFORE you run logging.basicConfig, the logging.basicConfig call doesn't have any effect. In fact, no logging occurs. Where is this behavior documented? I don't really understand. >>> More
Redirect logging output using custom logging handler

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi Guys, I'm using a module in my python app that writes a lot a of messages using the logging module. Initially I was using this in a console application and it was pretty easy to get the logging output to display on the console using a console handler. Now I've developed a GUI version of my app… >>> More
Java Logger API

as seen on Oracle Blogs - Search for 'Oracle Blogs'
This is a more like a tip rather than technical write up and serves as a quick intro for newbies. The logger API helps to diagnose application level or JDK level issues at runtime. There are 7 levels which decide the detailing in logging (SEVERE, WARNING, INFO, CONFIG, FINE, FINER, FINEST)… >>> More

Related posts about syslog

WD MBWE II (White Strip Light) 2TB - unable to access data

as seen on Super User - Search for 'Super User'
I have a WD MBWE II (White Strip Light) 2TB - (WD20000H2NC-00) Was working fine until a few days ago. I guess there was a power failure and after that I am unable to access the 'Public' or the 'Download' folder anymore. I have been searching for answers everywhere but came up empty handed. Web… >>> More
Logs are written to *.log.1 instead of *.log

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
For some reason my log files are writing to the *.log.1 files instead of the *.log files, e.g. for my Postfix log files it is writing to /var/log/mail.log.1 and not /var/log/mail.log as expected. Same goes for mail.err. It looks like it's also doing it for auth.log and syslog. Here is a ls -lt snippet… >>> More
syslog-ng and nging logs to mysql

as seen on Server Fault - Search for 'Server Fault'
So couple of days ago I asked how to log php and nginx logs to centralized MySQL database, and m0ntassar gave a perfect answer :) cheer ! The problem I am facing now is that I can not seem to get it working. syslog-ng version: # syslog-ng --version syslog-ng 3.2.5 This is my nginx log format: log_format… >>> More
Python - retrieving info from a syslog file

as seen on Stack Overflow - Search for 'Stack Overflow'
Ive been asked to do a program using python for an assignment. Ive been given a syslog file and I have to find things out about it How do I find out how many attempts were made to login to the root account? Any advice would be highly appreciated as Im very new to python an completely lost! >>> More
How can i monitor syslog messages in c# console app with TCP

as seen on Stack Overflow - Search for 'Stack Overflow'
Heya, In my application, i need to monitor all messages sent by syslog. I've tried with UDP, but after one message, i didn't respond anymore (no error, just no heads up anymore). And setting up a tcp server isn't really the solution either i think. Can anyone guide me to a solution where i can log… >>> More