topic Re: Filter events on indexer from multiple universal forwarders in Getting Data In

Filter events on indexer from multiple universal forwarders

takemusu — Fri, 18 Apr 2014 13:54:21 GMT

We've about 20 universal forwarders monitoring different log files. Our system doesn't allow to use heavy forwarders because of their performance impact on data indexing.
These universal forwarders send their data to a couple of indexers.

I've read Route and filter data docu (Discard specific events and keep the rest section). My question is that as we have different source log files located on different boxes, how would I refer them in props.conf file:

[source::?????] TRANSFORMS-null= setnull

For example, on one box I monitor /log/log.1 and on another /log/log.2.
Should I point the hostname after the source:: as well? Could somebody show an example?

Thanks in advance,
Alexey

Re: Filter events on indexer from multiple universal forwarders

martin_mueller — Fri, 18 Apr 2014 16:45:21 GMT

Do those files use the same sourcetype? If so, put the TRANSFORMS-foo value under that sourcetype.

Re: Filter events on indexer from multiple universal forwarders

takemusu — Mon, 21 Apr 2014 07:45:36 GMT

Yes, for now these files are using the same sourcetype (log4j). When you say put the TRANSFORMS-foo value under that sourcetype - do you mean editing sourcetype.conf?

Re: Filter events on indexer from multiple universal forwarders

martin_mueller — Mon, 21 Apr 2014 09:33:26 GMT

Editing sourcetypes.conf rarely ever is required, your own sourcetype settings reside in props.conf.

Put your transforms list under your common sourcetype log4j in props.conf:

[log4j]
TRANSFORMS-null = ...

Remember, this will affect every event with sourcetype=log4j regardless of host and sourcetype.