title: Logstash keep syslog host
body: <p>I have a syslog server and the ELK stack on the same server. I have a directory for each syslog source.
  I'm trying to parse syslog files with Logstash, and I'd like to keep the ip adress or the hostname of the syslog source in the "host" field. At the moment I have the 0.0.0.0 source after Logstash parsing.</p>
  
  <p>My logstash.conf :</p>
  
  <pre><code>input {
    file {
      path =&gt; ["path/to/file.log"]
      start_position =&gt; "beginning"
      type =&gt; "linux-syslog"
      ignore_older =&gt; 0
    }
  }
  
  filter {
    if [type] == "linux-syslog" {
      grok {
        match =&gt; {"message" =&gt; "&lt;%{POSINT:syslog_pri}&gt;%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
      }
    }
  }
  
  output {
    elasticsearch {
      hosts =&gt; ["@IP_Elastic:Port_Elastic"]
    }
  stdout { codec =&gt; rubydebug }
  }
  </code></pre>