connection_host = dns not working

[lukasz92]

Hi,

I set new sourcetype: syslog-net for syslog events I don't want to extract host from.
My settings:

inputs.conf
[udp://55555]
connection_host = dns
disabled = 0
index = net
sourcetype = syslog-net

props.conf
[syslog-net]
MAX_TIMESTAMP_LOOKAHEAD = 32
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False
TIME_FORMAT = %b %d %H:%M:%S
category = Operating System
maxDist = 3
pulldown_type = true
TRANSFORMS =

Problem is that it sometimes (for some IP address) doesn't work. I see reverse dns requests to DNS server, but even if there are responses, I see some IP not resolved (10.26.x.y instead of resolved host name).

Do you have any ideas?

[ronekarleone]

I have only one idea. Your sourcetype from props.conf overwrite resolved host field. You can read about it input.conf example:

* If the input is configured with a 'sourcetype' that has a transform that   overrides the 'host' field e.g. 'sourcetype=syslog', that will take precedence over the host specified here.