What is the Logstash "host" field source data?

[barrydekong]

There is "host" field at logstash for filtering the logs with hash value, can anyone tell me the host refer to what kind of host (host name hash/host IP hash or others. I think it should be unique identifier of the source network connection, please correct me if I was wrong.

[Ganesh-403]

@barrydekong
The meaning of the host field depends on how the event is created.

For a standard T-Pot/Logstash pipeline, host is not intended to be a unique identifier for the attacking system or network connection. Instead, it generally refers to the host that generated or collected the event (i.e. the machine where the log originated). In the Elastic Common Schema (ECS), the host.* field set describes the system on which the event happened or from which the measurement was taken—not the remote attacker. :contentReference[oaicite:0]{index=0}

So:

• host / host.name → The honeypot/server generating the log.
• source.ip (or src_ip in older T-Pot pipelines) → The remote attacker's IP.
• destination.ip (or dst_ip) → The honeypot's IP that received the connection. :contentReference[oaicite:1]{index=1}

If you're looking for a unique identifier for the attacker or connection, the host field is not the right choice. Depending on the honeypot and T-Pot version, you'd typically use fields such as:

• src_ip / source.ip for the attacker's IP.
• session, session_id, or a similar connection identifier (if provided by that honeypot).
• A combination of source.ip, destination port, and timestamp if you need to correlate events.

One thing to note is that T-Pot 20.06.x predates the widespread adoption of ECS, so you'll often see fields like src_ip and dst_ip instead of the newer ECS fields (source.ip, destination.ip). The exact field names therefore depend on the T-Pot version and the specific honeypot generating the event.

Could you clarify which host field you're referring to?

• The host field in the raw Logstash event?
• The host field shown in Kibana?
• Or a specific honeypot log (e.g. Cowrie, Dionaea, Suricata)?

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.