host lookup

[DTERM]

I'm getting some unexpected results when I run the following query for hosts:

index=mydata | top host

I expect to see a list of the top hosts in my index however I get back information such as eth0, eth1, sit0, sum, etc in my hosts column. This data is not accurate. When I click on one of the host fields to see get more information about the source, I see...

host=0.00 sourcetype=syslog source=/var/log/sa/sar15

What is causing this, and more importantly, how to stop it? Thanks in advance!

[Damien_Dallimor · Accepted solution]

It looks like you a monitoring a file....how are you specifying your host field extraction ?

[DTERM]

sar15 is not the host, just FYI... 🙂

[Damien_Dallimor]

I would change the sourcetype to something else.
ie: "my_log_file"

By using the "syslog" sourcetype , the default syslog host field transforms are getting invoked on your events.

That's why your host field is getting filled incorrectly.

from etc/system/default

props.conf

[syslog]
...
TRANSFORMS = syslog-host
...

transforms.conf

[syslog-host]
DEST_KEY = MetaData:Host
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)*[?(\w[\w.-]{2,})]?\s
FORMAT = host::$1

[DTERM]

[monitor:///var/log]
sourcetype = syslog
disabled = false
host = myhost

That is a paragraph in my inputs.conf file. Do I just need to remove that entire paragraph?

Thanks,

[Damien_Dallimor]

Correct , and there is also a "host_segment" option to consider.

[MHibbin]

To jump in, you should look at the inputs.conf file and "host_regex" option. So is "sar15" the host?

[DTERM]

I love the MARSHALL back ground!! Excellent. Regarding the host field extraction, how do I answer that? What file holds that information?