topic Re: Renaming Host Dynamically in Getting Data In

Renaming Host Dynamically

peter_gianusso — Tue, 18 Sep 2012 14:37:55 GMT

Trying to assign the "esxi_hosts" sourcetype to any event that has a value of "vm[0-9][0-9]" for the host field:

inputs.conf

[monitor://\\njros1bva0597\d$\LogFiles\W3SVC1\]
disabled = 0
host = VM99
index=imaging
whitelist = \.log$

props.conf

[source::...\\ex*.log] 
sourcetype = VM88

[source::...\\CAPPM*.log] 
sourcetype = VM11

[VM88]

TRANSFORMS-hostname = rewrite_sourcetype_from_host

transforms.conf

[rewrite_sourcetype_from_host]
SOURCE_KEY = MetaData:Host
REGEX = vm\d\d
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::esxi_hosts

Re: Renaming Host Dynamically

peter_gianusso — Tue, 18 Sep 2012 14:39:10 GMT

source type always ends up as VM88

Re: Renaming Host Dynamically

kristian_kolb — Tue, 18 Sep 2012 14:56:37 GMT

maybe I'm missing something... can't you just set the sourcetype in the monitor stanza in inputs.conf

[monitor] sourcetype=esxi_hosts blah blah blah etc. etc.

Re: Renaming Host Dynamically

peter_gianusso — Tue, 18 Sep 2012 14:59:20 GMT

there are multiple log files in the directory and they are being assigned a sourcetype in the props.conf dynamically...I tried to simplify the information because I didn't think it was relevant...I will add the stanza

Re: Renaming Host Dynamically

piebob — Tue, 18 Sep 2012 18:17:08 GMT

let us know if this fixes the issue, and i will convert Kristian's comment to an answer 🙂

Re: Renaming Host Dynamically

peter_gianusso — Tue, 18 Sep 2012 18:18:47 GMT

no that won't fix the issue given the scenario...the source type is dynamically assigned in the props.conf

Re: Renaming Host Dynamically

peter_gianusso — Tue, 18 Sep 2012 18:19:37 GMT

a fix to the regex of
vm\d\d
to
VM\d\d
fixed the issue