Prior to setting connection_host to DNS for udp:514, all my hosts sending data via syslog got indexed with the host field being an IP address. After making that change, almost all of the hosts switched to having fully qualified names but 5 of those hosts continue to be indexed with an IP address instead of a fully qualified domain name.
I used the lookup command like this (note I am not using a real IP address)
host="192.168.16.12*" | rename host AS clientip | lookup dnslookup clientip
After running the command, those hosts, which continue to be indexed with host as an ip do resolve to a fully qualified name so where do I look to resolve this problem?
I am having this same issue. A handful of servers resolve the correct host name and most give ip
connection_host = dns
sourcetype = syslog
disabled = 0
index = main
no_appending_timestamp = true