How do I get the Hosts list in Search to not show syslog words as hosts?

[mikeely]

I've set up two linux machines as forwarders, and suddenly I have a very large number of entries in the hosts field which appear to simply be distinct words in the various syslog files. The host adding the vast majority of the fake hosts is running OpenSuSE 11.4, but a RHEL box also created two host entries (one upper case and one lower case). The inputs.conf for both hosts couldn't be any simpler:

[monitor:///var/log]

disabled=false

followTail=1

sourcetype=syslog

Here's a screenshot of the problem so you can see what I mean. The blurred names are actual hosts:

[mikelanghorst · Accepted solution]

I would recommend removing the "sourcetype=syslog" from your monitor stanza. Many logs under that path may not be syslog format. Telling it to treat all of these logs as a syslog file, which will extract the 4th field of the line to be the hostname.

Then if you have specific file sources, add them to props.conf entries and assign them to sourcetype=syslog.