# Log viewer shows wrong host for all syslog entries

**URL:** <https://community.influxdata.com/t/log-viewer-shows-wrong-host-for-all-syslog-entries/7349>\
**Category:** Systems\
**Created:** [November 9, 2018, 1:58pm UTC](https://community.influxdata.com/t/log-viewer-shows-wrong-host-for-all-syslog-entries/7349 "2018-11-09T13:58:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aspitzer](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@aspitzer](https://community.influxdata.com/u/aspitzer)\
**Post date:** [November 9, 2018, 1:58pm UTC](https://community.influxdata.com/t/log-viewer-shows-wrong-host-for-all-syslog-entries/7349/1 "2018-11-09T13:58:21Z")

</div>

All of our servers send to a central rsyslog server.

I followed the instructions like these to (re)forward syslog entries to telegraf

> [@Enabling the Syslog Log](https://community.influxdata.com/t/enabling-the-syslog-log/5604):
>
> I’m working with the latest nightly builds, and trying to get the syslog plugin working without much success. Running it on my Mac, I get no entries from syslog. I also tried enabling the tail plugin and pointing it to /usr/local/var/log/\*\*.log as suggested in the Telegraf config file, but all that served to do was create massive telegraf.log files due to all the parse errors. I’ve also tried enabling this on a linux variant, but with equally unsatisfying results. In reading through the config …

and setup [input.syslog] for telegraf running on the syslog server.

All the syslog entries are now viewable in the log viewer, but “Host” is always showing the name of our syslog server and not the server that actually wrote the syslog entry.

If you note on the image I have uploaded, all the entries say the host is “RDRE1-PLMON01” (which is the syslogserver) and not the name of the host the alert came from.

 ![syslog-server-name](https://us1.discourse-cdn.com/flex023/uploads/influxdata/original/2X/6/6d8e5418d73f82761236c76735e05b2c6f9aff1b.png)

This leads me to believe that [input.syslog] is really designed for every server to send only its own syslog entries to its own telegraf instance. Either way, this seems like a bug to me. Telegraf should be using column 4 of the syslog entry as the host, and not just taking the hostname of the host that is streaming the data to it.

Has anyone else use a centralized syslog server and used it as the single source of data for [input.syslog]?

Thanks!

---

<div class="post-metadata">

**Author:** ![daniel](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/daniel/32/142_2.png) [@daniel](https://community.influxdata.com/u/daniel)\
**Post date:** [November 9, 2018, 9:45pm UTC](https://community.influxdata.com/t/log-viewer-shows-wrong-host-for-all-syslog-entries/7349/2 "2018-11-09T21:45:39Z")

</div>

The host that generated the log message is saved in the `hostname` tag.

To give you some background, in Telegraf the `host` tag is used to indicate what host Telegraf is running on, not the source of the metrics. In the future, we are planning to use a tag called `source` to hold the hostname which the metrics are about, but this plan is still early and not added to very many plugins yet.

---

<div class="post-metadata">

**Author:** ![aspitzer](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@aspitzer](https://community.influxdata.com/u/aspitzer)\
**Post date:** [November 10, 2018, 2:50pm UTC](https://community.influxdata.com/t/log-viewer-shows-wrong-host-for-all-syslog-entries/7349/3 "2018-11-10T14:50:49Z")

</div>

Hi Daniel!

I did see the “hostname” in the fields (in the preferences/cog icon). I swapped the hostname with host, but the hostname field does not seem to show up as a column at all in the viewer.

Thanks!