The 3rd party tool that collects and analyzes (syslog) logs is strictly working in a general syslog layout:
Nov 12 16:19:57 hostname username: ERROR ..message..
where the hostname should not be FQDN, but a short name one instead. For example, instead of "thisserver.xyz.mars" it should just be a "thisserver". In fact logging from a shell using a "logger" results in a a short host name by default.