Can phyton script modify a log event on the fly in a universal forwarder?

lpolo — Thu, 29 Mar 2012 18:16:47 GMT

Can a phyton script modify a log event on the fly in a universal forwarder?

For example:

file.log:

timestamp <id=xxxx>{
json content
}

log event to be forwarded:

file.log:

{
"timestamp : "xx/xx/xx:xx:xx:xx",
"id" : "xxxx"
json content
}

Thanks for your guidance.

Re: Can phyton script modify a log event on the fly in a universal forwarder?

dwaddle — Thu, 29 Mar 2012 20:06:19 GMT

This cannot be done at the Universal Forwarder. I'm not even sure it can be (simply) done at the indexer.