Hostnames

[kevin-sback]

How do you get the hostnames to show up for the source rather then IP's. I have DNS configured with reverse lookups as well. I can only get it to work with the Syslog UDP but not the raw/plaintext syslog. Problem with the Syslog UDP you don't get all the extracted information as you do with the raw. Any suggestions / ideas would be greatly appreciated.

[chillobill]

In the code that relates to the extractor for message source change the regex value to be ">[0-9]*?: ([^ ]+?):"

e.g.

      "title": "Source",
      "extractor_type": "regex",
      "converters": [],
      "order": 2,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "source",
      "extractor_config": {
        "regex_value": ">[0-9]*?: ([^ ]+?):"

On the Cisco device in global configuration mode enter the command logging origin-id hostname this will tell the router/switch to send the hostname in the syslog messages. I prefer this way as it means you dont necessarily need to have reverse DNS entries for all your devices and doesn’t place any additional load on the graylog & dns servers.

As a failsafe I have also tried to ensure that if the Cisco devices are not configured with the logging origin-id hostname then the regex intentionally does not match anything meaning Graylog will display the IP as the source.

See example http://regexr.com/3ea4h

[fowleryomi]

Hi, I have same issue.
can you please specify the path where the code for the extractor can be found.