In each log message, there is a field “source”, which displays hostname (hostname -f). But in my case, this is the hostname of Kubernetes pode(for example, k8s-worker-w-c1-9-57f7fc98f6-5w2bz), which contains many Docker containers.
For each Docker container in the pode we set system property “cloud.hostname” with the appropriate value(for example, k8s-worker-w-c1-9_1, k8s-worker-w-c1-9_2, k8s-worker-w-c1-9_3 …).
I want to see in the “source” or another field in the log message value of system property “could.hostname”. How I can do it?
The graylog recognise the hostname from the syslog message.
So first, try to change your source to send your wish.
If you can’t set it on source, you can use many solutions at graylog’s side. reverse DNS check, pipeline, csv files, extractors, to change the source fild from the syslog message, or from manual database.
Unfortunately I haven’t got docker, so I can’t tell how can you set it ion your source side. But I think it is the easiet solution.
