Yep chain_hostnames or the combination of the two were the suspect. I forgot I had set it in a global conf. 


Good table here. 

https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/reference-options.html



On Thu, Jun 8, 2017 at 4:14 PM, Fabien Wernli <wernli@in2p3.fr> wrote:
On Thu, Jun 08, 2017 at 11:07:49AM -0700, Evan Rempel wrote:
> That is what you get when you set keep_hostname(yes)

I think you meant chain_hostnames(yes)

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq