Seems like nobody can agree on what constitutes "correct" behavior.

Since everyone disagrees, we can make logstash do what you want. You can use the mutate filter to replace the 'host' field with whatever you want:

```
input { file { ... } }
filter { mutate { replace => { "host" => "my.host.name" } } }
...
```

If that doesn't satisfy you because you manually maintain your logstash configs, or something, you can use the 'environment' filter:

```
filter {
  environment {
    add_field_from_env => { "host" => "HOSTNAME" }
  }
}
```

With the above filter, set "HOSTNAME=$(hostname -f)" in your environment/shell and everything should just work.