ensure graylog source is correct (ITISFoundation#1189)

Author: sanderegg

services/logging/fluentd/fluent.conf

@@ -30,6 +30,8 @@
   @type forward
   port 24224
   bind 0.0.0.0
+  # Add source hostname to records
+  source_hostname_key source_hostname
 </source>
 
 # Add additional metadata
@@ -38,16 +40,18 @@
   <record>
     hostname "#{Socket.gethostname}"
     fluentd_hostname "#{ENV['FLUENTD_HOSTNAME']}"
-    tag ${tag}
   </record>
 </filter>
 
-# Clean container names (Ruby needed) by removing leading slashes
+# Clean container names and set proper host field
 <filter docker.**>
   @type record_transformer
   enable_ruby true
   <record>
+    # cleanup container names by removing leading slashes
     container_name ${record["container_name"] ? record["container_name"].sub(/^\//, '') : record["container_name"]}
+    # Use source hostname from forward input as the host field for GELF
+    host ${record["source_hostname"] || record["source"] || record["_hostname"] || "unknown"}
   </record>
 </filter>
 
@@ -64,6 +68,12 @@
     protocol udp
     add_msec_time true
     flush_interval 5s
+    # Use the host field from record for GELF host field
+    use_record_host true
+    # Map the correct fields for Graylog
+    <format>
+      @type json
+    </format>
     <buffer>
       @type file
       path /fluentd/buffer/graylog