title: log4j tcp appender and logstash source host
body: <p>I am shipping my logs from a tomcat instance to another machine using a log4j socketappender. On this remote server, I have logstash setup to do the transforms on the data, which then is forwarded to my elastic search cluster. For some reason I can't get the original host of the logs to show up in elastic search. I get the host of the logstash forwarders, but the host from the original log even does not persist through the pipeline.</p>
  
  <p>My logstash config</p>
  
  <pre><code>input {
    log4j {
      mode =&gt; "server"
      port =&gt; "4560"
    }
    tcp {
      port =&gt; "4561"
      codec =&gt; "json"
      type =&gt; "access"
    }
  }
  
  filter {
    mutate {
      add_field =&gt; [ "source_ip", "@source_host" ]
    }
    if [type] == "access" {
      mutate { remove_field =&gt; "something-private" }
    }
    ruby {
      code =&gt; "event['@timestamp'] = event['@timestamp'].localtime('-05:00')"
    }
    ruby {
      code =&gt; "event['@pretty_timestamp'] = event['@timestamp'].strftime('%A, %B %e %Y at %l:%M:%S %p')"
    }
  }
  
  output {
    elasticsearch {
      host        =&gt; "elasticsearch.host"
      cluster     =&gt; "log-cluster"
      protocol    =&gt; "http"
    }
  }
  </code></pre>
  
  <p>All the logs come through fine, but I wanna have their source host in them as well so I can tell what servers they are coming from. </p>
  
  <p>An average logevent coming through would be like this...</p>
  
  <pre><code>{
    "_index": "logstash-2015.01.28",
    "_type": "logs",
    "_id": "AUsyNvDyCso0hZPOUVfM",
    "_score": null,
    "_source": {
      "message": "Executing query: Removed",
      "@version": "1",
      "@timestamp": "2015-01-28T15:23:56.331-05:00",
      "host": "10.253.1.112:31441",
      "path": "org.blahblah",
      "priority": "INFO",
      "logger_name": "org.blahblah",
      "thread": "http-bio-8080-exec-13",
      "class": "?",
      "file": "?:?",
      "method": "?",
      "source_ip": "@source_host",
      "@pretty_timestamp": "Wednesday, January 28 2015 at  3:23:56 PM"
    },
    "sort": [
      1422476636331,
      1422476636331
    ]
  }
  </code></pre>
  
  <p>Any idea how to tune this to include the correct source host?</p>
  
  <pre><code>log4j.rootLogger=INFO, default, SOCKET, FILE
  log4j.appender.default=org.apache.log4j.ConsoleAppender
  log4j.appender.default.layout=org.apache.log4j.PatternLayout
  log4j.appender.default.layout.ConversionPattern=%d [%t] %-5p %c{1} - %m%n
  
  log4j.appender.SOCKET=org.apache.log4j.net.SocketAppender
  log4j.appender.SOCKET.Port=4560
  log4j.appender.SOCKET.RemoteHost=${logHost}
  log4j.appender.SOCKET.ReconnectionDelay=1000
  
  log4j.appender.FILE=org.apache.log4j.RollingFileAppender
  log4j.appender.FILE.File=${log_home}neuron-logging.log
  log4j.appender.FILE.MaxFileSize=100MB
  log4j.appender.FILE.layout=org.apache.log4j.PatternLayout
  log4j.appender.FILE.layout.ConversionPattern=%d{dd MMM yyyy HH:mm:ss,SSS} %p %t %c - %m%n
  </code></pre>
  
  <p>I add some catalina options -DlogHost= and -Dlog_home= blah blah</p>