Hi,
Usually when you see messages starting with <158> or similar numbers the input is not quite correct. Can you share your logstash config and your filters?
Edit: I am guessing that you are sending syslog messages but your input is a tcp / udp input filter. When you change the input filter to syslog, you should not see the <158> anymore
Paul.