How to maintain the log source host using logstash

if the field has already been matched to the record, and is available then you might be able to do this;

mutate {
    type => loc2
    replace => [ "@source_host","%{this_field}" ]
}

(though I have not tried replacing out the @source_host field before, but give it a try and let us know how it went... ;-)

the blog?