Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter.

In the exmaple the author replaces his @source_host with a string value but I'd like to use the actual value that is parsed from in this case a syslog.

mutate {
  type => loc1
  replace => ["@source_host", "loc1"]
mutate {
  type => loc2
 replace => ["@source_host", "loc2"]

How do I actually maintain the original source host in my logs?

share|improve this question
Can you add the link to the blog? – Joel E Salas Apr 14 '12 at 0:30

if the field has already been matched to the record, and is available then you might be able to do this;

mutate {
    type => loc2
    replace => [ "@source_host","%{this_field}" ]

(though I have not tried replacing out the @source_host field before, but give it a try and let us know how it went... ;-)

the blog?

share|improve this answer
I had already tried your suggestion when I originally attempted to use logstash between rsyslog and graylog and had no luck. I've since moved to just sending logs directly to graylog2 from rsyslog and it's working fine. I might revisit this again some day if I need to do more granular filtering and formatting of my logs with logstash. – Ray Rodriguez May 22 '12 at 9:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.