From 3aeaf7d3039563a86ec726e46fa51d9ce2fbea81 Mon Sep 17 00:00:00 2001 From: "Tuan T. Pham" Date: Thu, 21 Apr 2022 20:21:07 -0400 Subject: [PATCH] Update hostname for version1 logstash/formatter.py: * On logstash 8.x (maybe earlier too), the ip of the sender will be the field "host":{"ip": sender_ip} ``` logstash | { logstash | "event" => { logstash | "original" => "{}\n" logstash | }, logstash | "@version" => "1", logstash | "host" => { logstash | "ip" => "172.21.56.1" logstash | }, logstash | "@timestamp" => 2022-04-22T00:23:19.214302Z ``` So when we send the field "host": hostname, it will cause json parsing error in logstash receiver. Signed-off-by: Tuan T. Pham --- logstash/formatter.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/logstash/formatter.py b/logstash/formatter.py index 2b5d618..ad59464 100644 --- a/logstash/formatter.py +++ b/logstash/formatter.py @@ -122,7 +122,7 @@ def format(self, record): '@timestamp': self.format_timestamp(record.created), '@version': '1', 'message': record.getMessage(), - 'host': self.host, + 'host': {'hostname': self.host}, 'path': record.pathname, 'tags': self.tags, 'type': self.message_type,