Can you post the format-json output so we can see if the HOST attribute is there?

debug mode in syslog-ng should show that. Or alternatively you can use the same template to write to a throwaway logfile.

On Jan 25, 2017 5:56 AM, "Scot" <scotrn@gmail.com> wrote:
Elastic, Syslog-ng Kibana 

Upgraded to latest of ES Stack, Kibana 5 and syslog-ng 3.9.1

I had a Kibana dashboard with a bar chart of unique count of systems that had sent a syslog heartbeat. So I could see any missed heartbeats for any host in the last 24 hours.  

Post upgrade of syslog-ng the host_from, host fields do not seem to come into ES as usable fields because they are not indexed. So visualizations "bar charts by unique 'host" is broken. Has anyone seen this?  


                client-mode("http")
                index("syslog-ng_${YEAR}.${MONTH}.${DAY}")
                type("syslog") # Description: The type of the index. For example, type("test")
                template("$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n")




______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq