Beats input is stripping domain name

danny999 · June 19, 2018, 5:39pm

Hi Jochen and team:

I am testing Filebeat as a replacement for NXlog for inputting text files. I have setup a Beats input for Graylog, and it is receiving from my text file properly. So far so good.

The only problem is that the entries I see coming into Graylog have stripped down the hostname: they have removed the domain name. For example: In Graylog I would expect to see ‘machine1.mydomain.com’, but these log entries are simply from ‘machine1’.

Without using an extractor is there anyway to get the Beats input to display full hostnames like all my other inputs do?

jochen · June 19, 2018, 6:14pm

The Beats input is using the beat.hostname field from the Beats messages sent by Filebeat (or any other Beat).
https://www.elastic.co/guide/en/beats/filebeat/6.3/exported-fields-beat.html#exported-fields-beat

github.com

Graylog2/graylog-plugin-beats/blob/2.4.5/src/main/java/org/graylog/plugins/beats/BeatsCodec.java#L119




private Message createMessage(String message, Map<String, Object> event) {
    @SuppressWarnings("unchecked")
    final Map<String, Object> beat = (Map<String, Object>) event.remove("beat");
    final String hostname;
    final String name;
    if (beat == null) {
        hostname = "unknown";
        name = "unknown";
    } else {
        hostname = String.valueOf(beat.get("hostname"));
        name = String.valueOf(beat.get("name"));
    }
    final String timestampField = String.valueOf(event.remove("@timestamp"));
    final DateTime timestamp = Tools.dateTimeFromString(timestampField);
    final String type = String.valueOf(event.get("type"));
    final Object tags = event.get("tags");


    final Message result = new Message(message, hostname, timestamp);
    result.addField("name", name);
    result.addField("type", type);

github.com

Graylog2/graylog-plugin-beats/blob/2.4.5/src/test/resources/filebeat.json#L6-L9


"beat": {
  "hostname": "example.local",
  "name": "example.local"
},

Maybe you can configure the hostname of your system correctly. You can check the hostname with the hostname(1) command.

danny999 · June 19, 2018, 7:18pm

Hmm… when you run ‘hostname’ on Windows (Win10) it does not echo the full hostname with domain like it does when you run it on Linux (CentOS). I will find a workaround.

Thanks again

system · July 3, 2018, 7:18pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Windows DNS logs, FileBeat, Beats input on Graylog 3.1.3 Graylog Central (peer support) sidecar , filebeat-windows , winlogbeat , basic-configuration	13	3796	January 6, 2020
Unknown source with filebeat Graylog Central (peer support) sidecar , filebeat-windows , winlogbeat	3	2860	January 22, 2020
Filebeat unknown source field Graylog Central (peer support)	9	2133	March 17, 2022
Why doesn't Beats Input support keys_under_root? Graylog Add-ons	1	1656	September 7, 2017
Filebeat source file contains JSON Graylog Central (peer support)	1	324	June 17, 2020

Beats input is stripping domain name

Related topics