originHost set to IP address about logstash-gelf HOT 6 CLOSED

Hi Demetri,
this is an logback/network issue. Logback tries to resolve the local host name (forward/reverse) (see ch.qos.logback.core.util.ContextUtil/ContextUtil.java:35):

public static String getLocalHostName()

This runs in my case into an UnknownHostException which causes log back to fall back to the ip address. I've committed also some test cases into the repo to find out what's going on.

from logstash-gelf.

So, is the logback bug currently open or fixed? I see this: http://jira.qos.ch/browse/LOGBACK-749 Looks like you rev'd logback version dependency?

from logstash-gelf.

Yes, I've updated to 1.0.13. The logback bug is fixed. The bugfix causes logback not to crash any more but leads to supply the ip address (IPv4 or IPv6) when using HOSTNAME. You should get the right data a production environment where you have a DNS set up with correct setup hosts. (forward/reverse lookup entries).

from logstash-gelf.

Ahh, I understand your previous comment now, thanks. Is there an open issue against logback for this behavior? Seems to me requiring reverse DNS is not okay. We're behind a NAT here so all local workstations may show up as one "host". As I showed in my example, I can get the "correct" (preferred) hostname via the hostname command in logback.groovy. I double checked logback version on my end and it is also 1.0.13.

from logstash-gelf.

I was able to workaround my issue with the above additionalFields entry as well as adding to logstash the following:

filter {
if [type] == "gelf" {
mutate {
# Renames the 'originHost' field to 'host'
rename => [ "originHost", "host" ]
}
}
}

from logstash-gelf.

There is one more thing: logstash-gelf comes with an utility class RuntimeContainer, there you can find some constants which contain the hostname, FQDN and IP address. Check it out.

from logstash-gelf.