I also noticed this issue as the instructions for configuring tell you to add a sourcetype of nagios:core but most of the field extractions and macros are looking for a sourcetype of nagios . I updated my sourcetype to be nagios rather than nagios:core and some things started working, however some parts are still not working. ... View more