Try to use this GROK extractor (grok pattern) for message field:
%{MONTH} +%{MONTHDAY} %{YEAR} %{TIME} %{HOSTNAME:hostname}
And check Named captures only
This way you extract only hostname to field hostname.
1 Like