I recently configured syslog plugin to collect Datapower appliance logs. The Datapower end was set to syslog-tcp for a few events tagged with an Identifier.
I see most of the event logs are in proper format with the identifier tag. But there are also logs that are in unreadable format. How do I make sense of what the host and port are? There was no specific host set from Datapower end
Logstash version: 6.3
Please let me know what other details I need to attach.