Same issue I have. We have created a dedicated Index for UPS logs. Every syslog message coming from a client starting with ups in its hostname should store logs to this Index. It's not working for any of my UPS Systems. When I use a cisco router, change hostname to ups it's working. So my strong guess is that it is related to the UPS, but don't know why.