LM Logs multiple capture group parsing

I have two logsources for syslog and it’s not very easy to understand why, but it has something to do with the source IP address and resolvability or something.

All Syslog (IP):

• Method = IP
• Key = system.ips

All Syslog (Hostname)

• Method = IP
• Key = system.hostname

I’d have to a pcap on two different collectors to see the actual difference between them incoming since LM doesn’t surface any details about what actually came in (would be nice to see the raw data by turning up a debug level somewhere). 

All i know is if i change the applies to for either of these logsources so that they include the devices that should belong to the other logsource, the mapping suddenly, completely fails. They don’t get mapped to any devices at all.

Theoretically, these two logsources could be combined into one if you’re using collector v35.100+. This is because there’s a new “OR” option in the resource mapping section that should allow both of these mapping to exist side by side and allow one to work when the other fails. I haven’t been able to test yet because we’re not on that collector version across the board yet (it’s not GA yet, just early access/beta).