stumbled over a problem that sometimes I get hostnames from nxlog other times it's fqdns. Happens only with internal nxlog messages.I tired to fix this by using the Exec $Hostname = hostname_fqdn(); statement.
# Nxlog internal logs
Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
Exec $Hostname = hostname_fqdn();