I am putting apache2 access logs via gelf with fluentd to graylog. Messages in the td-agent.log leave the host like this:
2019-07-30 08:22:25.000000000 +0200 apache.access: {"host":"x.x.x.x","user":"-","method":"GET","path":"/urz/nagvis/server/core/ajax_handler.php?mod=Multisite&act=getMaps&_ajaxid=1564467745","protocol":"HTTP/2.0","code":"200","size":"495","referer":"https://host/urz/check_mk/side.py","agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36"}
In graylog the host filed is missing and the protocol field always shows ‘0’. If I rename host to client ip address is shown correct. If I rename protocol to proto field has correct value ‘HTTP/2.0’ and protocol is still ‘0’.
What’s the reason for this and how can I use the fields ‘host’ and ‘protocol’?