topic Re: props.conf precedence in Getting Data In

props.conf precedence

afaraino — Mon, 19 Sep 2011 09:38:45 GMT

Hi Everyone,

I'm having a little issue related with props.conf precedence. I want to apply a transforms stanza to set a sourcetype, then another stanza to extract the Metadata:Host field for this sourcetype. I tried this in props.conf :

[source::udp:514]
TRANSFORMS-changesourcetype = set_juniper-sa-access
[juniper-sa-access]
TRANSFORMS-changehost = juniper-sa-access_host

...but it's not working. The first transform sets the sourcetype to juniper-sa-access but the second one never applies.

If I change to that, it's working, but it's not the desired behaviour :

[source::udp:514]
TRANSFORMS-changesourcetype = set_juniper-sa-access
TRANSFORMS-changehost = juniper-sa-access_host

Any clue?

Is it about precedence (source > host > sourcetype)? or is it because the sourcetype is set "too late" for matching the second stanza?

Best Regards,

Alexandre Faraino

Re: props.conf precedence

afaraino — Mon, 19 Sep 2011 13:34:42 GMT

The transforms.conf is read only once. So this is a "by design" behavior. I'll try something else.

Alex

Re: props.conf precedence

gkanapathy — Mon, 19 Sep 2011 14:37:38 GMT

Your easiest solution is to just sourcetype = juniper-sa-access in the inputs.conf where you define the [udp://514] stanza. All data from that input will be marked with that sourcetype.

Re: props.conf precedence

gkanapathy — Mon, 19 Sep 2011 14:37:40 GMT

Your easiest solution is to just sourcetype = juniper-sa-access in the inputs.conf where you define the [udp://514] stanza. All data from that input will be marked with that sourcetype.

Re: props.conf precedence

afaraino — Wed, 09 Nov 2011 09:11:36 GMT

Actually, I can't : not all logs received on udp:514 are juniper-sa-access. The stanza set_juniper-sa-access contains a regex to check the format.