Home / server / Questions / 562229
Accepted
Eric
Asked: 2013-12-19 07:57:55 +0800 CST

Logstash Groking Syslog Events

  • 772

I have a logstash server sending events to an elasticsearch server that is displaying the results in Kibana. Everything is working pretty good, other than Kibana is showing 2 names in the host field. I am using the following grok filter in logstash.

^(?:<%{POSINT:syslog_pri}>)?%{SYSLOGTIMESTAMP:timestamp} %{IPORHOST:host} (?:%{PROG:program}(?:\[%{POSINT:pid}\])?: )?%{GREEDYDATA:message}

When I use the Grok debugger, everything is parsed out correctly. However when I view it in Kibana, it shows this:

"host": [
  "logstash1",
  "servername.domain.com"
],

Where logstash1 is the name of my logstash server that is doing the parsing and sending to elasticsearch. I'm not sure why it is showing both the logstash server and the actual source as the host. How can i remove the logstash1 from the host field? An example of the logs are:

Dec 18 00:00:08 servername.domain.com pam_rhosts_auth[24233]: allowed to [email protected] as user1
elasticsearch

1 Answers

  1. Best Answer

    Checkout overwrite option http://logstash.net/docs/1.3.1/filters/grok#overwrite

    grok{
...
    overwrite => [ "host" ]
...
}
    • 3