topic Issue with setting up my forwarders to Syslog servers in Getting Data In

Issue with setting up my forwarders to Syslog servers

jorgepinto1 — Thu, 31 Aug 2017 16:18:16 GMT

Hi,

I have the following setup on my heavy forwarder:

outputs.conf

[tcpout]
defaultGroup = default-autolb-group
indexAndForward = 0

[tcpout:default-autolb-group]
disabled = false
server = indexer1:9997,indexer2:9997

[syslog]
defaultGroup=nothing

[syslog:syslogGroup1]
server = server1:514

[syslog:syslogGroup2]
server=server2:53215

transform.conf

[send_to_syslog1]
REGEX = .*%ASA-\d+-(111008|106100).*
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup1

[send_to_syslog2]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup2

props.conf

[host::host1]
TRANSFORMS-host_! = send_to_syslog1

[host::hosts*]
TRANSFORMS-hosts = send_to_syslog2

This setup is not working, can someone help?

Regards

Jorge

Re: Issue with setting up my forwarders to Syslog servers

jorgepinto1 — Fri, 01 Sep 2017 11:03:24 GMT

Of course, the objective is to forward all the data to the indexers, the data from host1 that matches the regex specified to syslog1 and all the data from several hosts to syslog2

Re: Issue with setting up my forwarders to Syslog servers

alemarzu — Fri, 01 Sep 2017 13:25:43 GMT

Hi there @Jorgepinto1

Can you try to specify the hostnames on the second stanza inside the props.conf to see what happens I believe that the current configuration is redundant. And also, be aware of the admiration sign ("!) on the first one.

[host::host1]
 TRANSFORMS-host_1 = send_to_syslog1

 [host::(host2|host3|host4)]
 TRANSFORMS-hosts = send_to_syslog2

Perhaps you mistyped it but make sure that your filename is called transforms.conf instead of transform.conf

Re: Issue with setting up my forwarders to Syslog servers

jorgepinto1 — Fri, 01 Sep 2017 14:06:13 GMT

This is the biggest oops I've posted here. Thank you very much Alemarzu.

Transform.conf vs transforms.conf

Re: Issue with setting up my forwarders to Syslog servers

alemarzu — Fri, 01 Sep 2017 14:18:22 GMT

It happens sometimes. Glad we could solved it!