derp, forgot that the domains end in a .

The domains in the logs end in a ".", so the decoder was picking up "ossec.net." and this caused some issues.