# Missing mandatory "host" field - EKS - Fluentbit

**URL:** <https://community.graylog.org/t/missing-mandatory-host-field-eks-fluentbit/29268>\
**Category:** Graylog Central (peer support)\
**Created:** [June 22, 2023, 12:57pm UTC](https://community.graylog.org/t/missing-mandatory-host-field-eks-fluentbit/29268 "2023-06-22T12:57:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lucardcoder](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/lucardcoder/32/15012_2.png) [@lucardcoder](https://community.graylog.org/u/lucardcoder)\
**Post date:** [June 22, 2023, 12:57pm UTC](https://community.graylog.org/t/missing-mandatory-host-field-eks-fluentbit/29268/1 "2023-06-22T12:57:03Z")

</div>

Hello all,  
I am fairly new to Graylog and currently working on getting graylog running in EKS.

I use a non official graylog helm chart that has mongodb and opensearch integration.

I also use fluentbit as the processor.  
After setting everything up, I can get the logs but below repeated warning fills the journal:

```auto
2023-06-21T22:40:01.215558613Z stdout F 2023-06-21 22:40:01,215 WARN [GelfCodec] - GELF message <8ec644f1-1084-11ee-88ee-ea5420893a8a> (received from <10.10.1.38:39263>) is missing mandatory "host" field. - {}

```

This Warning message comes from the datadog pod itself.

my fluentbit conf:

```auto
    [OUTPUT]
        Name gelf
        Match *
        Host graylog
        Port 12201
        Mode udp
        Gelf_Short_Message_Key log

```

I saw similar posts with missing mandatory host field issue but not specific to Kubernetes with a clear answer. Ideal outcome should not be getting this repeated warning message. Is there an additional step that I am missing? Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![drewmiranda-gl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/drewmiranda-gl/32/13376_2.png) [@drewmiranda-gl](https://community.graylog.org/u/drewmiranda-gl)\
**Post date:** [June 22, 2023, 4:40pm UTC](https://community.graylog.org/t/missing-mandatory-host-field-eks-fluentbit/29268/2 "2023-06-22T16:40:25Z")

</div>

Reading through [https://docs.fluentbit.io/manual/pipeline/outputs/gelf](https://docs.fluentbit.io/manual/pipeline/outputs/gelf) it looks like you may need to specify `Gelf_Host_Key`.

> Key which its value is used as the name of the host, source or application that sent this message. ( **MUST be set in GELF** )

Can you try setting that?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 6, 2023, 4:41pm UTC](https://community.graylog.org/t/missing-mandatory-host-field-eks-fluentbit/29268/3 "2023-07-06T16:41:10Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.