# Source client appears as a month name **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** sidecar, filebeat-windows\ **Created:** [June 20, 2019, 7:01pm UTC](https://community.graylog.org/t/source-client-appears-as-a-month-name/10891 "2019-06-20T19:01:27Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![washington.gomez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/washington.gomez/32/4638_2.png) [@washington.gomez](https://community.graylog.org/u/washington.gomez)\ **Post date:** [June 20, 2019, 7:01pm UTC](https://community.graylog.org/t/source-client-appears-as-a-month-name/10891/1 "2019-06-20T19:01:28Z")
I have 3 server installed with windows server 2016. I send the event viewer log to graylog2. 2 of 3 server i dont have problem, the source was right, show the server name. The another server show in the source field jun. instead the server name. How can i solved this error? Thanks ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 21, 2019, 9:31am UTC](https://community.graylog.org/t/source-client-appears-as-a-month-name/10891/2 "2019-06-21T09:31:54Z")
how did you send the windows logs to your graylog? ---
**Author:** ![washington.gomez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/washington.gomez/32/4638_2.png) [@washington.gomez](https://community.graylog.org/u/washington.gomez)\ **Post date:** [June 21, 2019, 12:06pm UTC](https://community.graylog.org/t/source-client-appears-as-a-month-name/10891/3 "2019-06-21T12:06:16Z")
Hi Jan, thanks for taking the time to answer me. I use solarwinds Event LogForwarder tool. After install and test different options (filebeat, nxlog, etc.) I found that this is the easier way to send my Windows log to Graylog. Unfortunaly , I have this 2 cases where graylog receive “jun.” instead the server name in the source field. Both server are the third node in a always on cluster , and i use them to decide (vote) in each cluster about the master/slave rol. I don´t know if this information is helpfull. Thanks again. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 21, 2019, 1:16pm UTC](https://community.graylog.org/t/source-client-appears-as-a-month-name/10891/4 "2019-06-21T13:16:02Z")
what kind of transport did you use? That is the most important information. I did never used that one but I guess it uses Syslog? You should check the syslog format that you send - as the one with the false source might have configured something different. You could create a RAW input and point your servers to that one and compare the received messages. ---
**Author:** ![washington.gomez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/washington.gomez/32/4638_2.png) [@washington.gomez](https://community.graylog.org/u/washington.gomez)\ **Post date:** [June 21, 2019, 2:12pm UTC](https://community.graylog.org/t/source-client-appears-as-a-month-name/10891/5 "2019-06-21T14:12:35Z")
Yes , sorry, i don´t give this information before. I am using udp to send the log to graylog, but i test with udp too, and same result. I will créate this raw input and let you know ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [July 5, 2019, 2:12pm UTC](https://community.graylog.org/t/source-client-appears-as-a-month-name/10891/6 "2019-07-05T14:12:36Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.