topic Specify all hosts or sources in props in Getting Data In

Specify all hosts or sources in props

lucacaldiero — Mon, 15 Sep 2025 07:22:18 GMT

How can I specify all host or sources in a stanza of props.conf?

Thank you

@gcusello

Re: Specify all hosts or sources in props

livehybrid — Mon, 15 Sep 2025 09:57:19 GMT

Hi @lucacaldiero

You can use the following stanza to target all sources in props:

[source::...] yourKey=yourVal

... recurses through directories until the match is met
or equivalently, matches any number of characters.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Specify all hosts or sources in props

PickleRick — Mon, 15 Sep 2025 11:07:34 GMT

1. Please don't tag specific people in a question. This is not a "free support" group. It's a community-driven forum where people simply voluntarily help each other if/when they have spare time. Tagging specific people might not only look "demanding" from the tagged person(s) but may also make others ignore your question.

2. Depends on what you want to achieve. A source-based stanza like in @livehybrid 's post is one way. Another way to target all data could be to use the [default] stanza.

Re: Specify all hosts or sources in props

gcusello — Mon, 15 Sep 2025 12:12:42 GMT

Hi @lucacaldiero ,

only for source and host, you can use the asterisk in the props.conf, e.g.:

[host::nyc*] ...

[source::/var/log/*] ...

not for sourcetype that must be exactly declared.

Ciao.

Giuseppe