set host value based on event

tuxford — Tue, 17 Apr 2012 10:36:37 GMT

Hello

I'm trying to set host based on value in an event, but it uses the default value and I'm trying to figure out why that is. My config looks like this:

transforms.conf

[janus]
DEST_KEY=MetaData:Host
REGEX=((?<=\d\d:\d\d:\d\d\s)[\w-\.]+)
FORMAT=host::$1

props.conf

[source::/var/log/syslog_vpn]
TRANSFORMS-janus=janus
SHOULD_LINEMERGE=false
sourcetype=vpn

[source::/var/log/syslog_info]
TRANSFORMS-janus=janus
SHOULD_LINEMERGE=false
sourcetype=ciscone

inputs.conf

[monitor:///var/log/syslog_info]
index=test

[monitor:///var/log/syslog_vpn]
index=test

I know my regex works since I've tested it with this rex in my search that replaces all the hostnames within the event to XXX: rex mode=sed "s/((?<=\d\d:\d\d:\d\d\s)[\w-\.]+)/XXX/g"

Re: set host value based on event

tuxford — Tue, 17 Apr 2012 13:41:31 GMT

So I finally figured it out, the config that I tried were put on the universal forwarder and was not honored, when put on the indexer it was all good.

Re: set host value based on event

MuS — Tue, 17 Apr 2012 14:17:26 GMT

Hi tuxford, without tweaking the UF ignores props.conf and transforms.conf. Good you figured it out 😉

topic Re: set host value based on event in Getting Data In

set host value based on event

Re: set host value based on event

Re: set host value based on event