How to maintain the log source host using logstash
if the field has already been matched to the record, and is available then you might be able to do this;
mutate {
type => loc2
replace => [ "@source_host","%{this_field}" ]
}
(though I have not tried replacing out the @source_host field before, but give it a try and let us know how it went... ;-)
the blog?