Hi,
I set new sourcetype: syslog-net for syslog events I don't want to extract host from.
My settings:
inputs.conf
[udp://55555]
connection_host = dns
disabled = 0
index = net
sourcetype = syslog-net
props.conf
[syslog-net]
MAX_TIMESTAMP_LOOKAHEAD = 32
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False
TIME_FORMAT = %b %d %H:%M:%S
category = Operating System
maxDist = 3
pulldown_type = true
TRANSFORMS =
Problem is that it sometimes (for some IP address) doesn't work. I see reverse dns requests to DNS server, but even if there are responses, I see some IP not resolved (10.26.x.y instead of resolved host name).
Do you have any ideas?
I have only one idea. Your sourcetype from props.conf overwrite resolved host field. You can read about it input.conf example:
* If the input is configured with a 'sourcetype' that has a transform that overrides the 'host' field e.g. 'sourcetype=syslog', that will take precedence over the host specified here.