It's a bug introduced in 4.2. It affects syslog and windows event log processing in fields "source" and "tag".
Bug is fixed, will be in next patch release.
Meanwhile you can put * character in source, it should work that way.
Bug is fixed, will be in next patch release.
Meanwhile you can put * character in source, it should work that way.