Links status based on sysloghost and message

[azasypkin]

@mushfiq

Deleted old index and created new one but still "message is not aggregatable.

So you updated message_field, and should have message_field.keyword. Don't you see it in Kibana? If not, try to refresh index pattern mapping cache like described here

Best,
Oleg