From 1b3fe9f05c0268c0ff417c884966c707bfffde53 Mon Sep 17 00:00:00 2001 From: Ian Pye Date: Fri, 17 Jan 2025 14:59:38 -0800 Subject: [PATCH] When syslog sends a hostname as ip, try looking up --- pkg/inputs/syslog/syslog.go | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/pkg/inputs/syslog/syslog.go b/pkg/inputs/syslog/syslog.go index 270c38f8..f7ae04c9 100644 --- a/pkg/inputs/syslog/syslog.go +++ b/pkg/inputs/syslog/syslog.go @@ -225,15 +225,21 @@ func (ks *KentikSyslog) formatMessage(ctx context.Context, msg sfmt.LogParts) ([ if hostname, ok := msg["hostname"]; ok { if hs, ok := hostname.(string); ok { if ipr := net.ParseIP(hs); ipr != nil { - if ks.resolver != nil { - resolved_name := ks.resolver.Resolve(ctx, hs, true) - if resolved_name != "" { - msg["device_name"] = resolved_name + // First check if this ip is in our devices list. + if dev, ok := ks.devices[hs]; ok { + msg["device_name"] = dev.Name // Copy in any of these info we get + dev.SetMsgUserTags(msg) + } else { // If not, try to resolve via dns. + if ks.resolver != nil { + resolved_name := ks.resolver.Resolve(ctx, hs, true) + if resolved_name != "" { + msg["device_name"] = resolved_name + } else { + msg["device_name"] = hs + } } else { msg["device_name"] = hs } - } else { - msg["device_name"] = hs } } else { msg["device_name"] = hs