Hi @gcusello , The sourcetype definition was a problem. Removing the EVA-host definition solved the issue. Thank you for your response. ... View more

The props.conf contains this EVAL-host = if ( host LIKE "gea%", case( host = "gea03", "gea03.n1data.lan", host="gea04", "gea04.n1data.lan", host="geadist", "geadist.n1data.lan", host="gea05", "gea05.n1data.lan"), $host$) The problem is only for the events from the machine gea05.n1data.lan Could you be kind enough to look at this expression.  I tried adding host value in inputs.conf but it did not help. ... View more

Hi @gcusello , Thanks for quick response . Logs are from a forwader In the inputs.conf, there is no static assignment of host. It looks like following [monitor:///var/log/httpd/ssl_error_log] index = index1 sourcetype = apache_error disabled = 0 [monitor:///var/log/httpd/access_log] index = index1 sourcetype = access_combined disabled = 0 I am getting host information for ssl_error.log events, but don't get it for access.log. ... View more