topic Re: How to configure IP range in inputs.conf on heavy forwarder in Getting Data In

How to configure IP range in inputs.conf on heavy forwarder

nzarzyckivs — Tue, 09 Oct 2018 11:54:34 GMT

I have logs coming to a heavy forwarder being stored under directories based on IPs (i.e. " /var/log/remote/192.168.1.6"

How do I use inputs.conf to capture a range of IPs while setting the index and sourcetype? This doesn't work:

[monitor:///var/log/remote/192.168.1.*/*.log]
 host_segment=4
 sourcetype=bar
 index=foo

Re: How to configure IP range in inputs.conf on heavy forwarder

nzarzyckivs — Tue, 29 Sep 2020 21:31:50 GMT

To elaborate further, what I'm trying to do is tag all directories with IP names with the same index and sourcetype before being forwarded to my indexers. So:

/var/log/remote/192.168.1./.log

The below did not work:

[monitor:///var/log/remote/192.168.1*./*.log]
host_segment=4
sourcetype=bar
index=foo

Re: How to configure IP range in inputs.conf on heavy forwarder

Anonymous — Tue, 06 Nov 2018 10:53:13 GMT

Do you get any error messages in the console`?

Re: How to configure IP range in inputs.conf on heavy forwarder

Anonymous — Tue, 06 Nov 2018 10:53:48 GMT

Do you recieve any messages in the web console?

Re: How to configure IP range in inputs.conf on heavy forwarder

skalliger — Tue, 06 Nov 2018 11:30:51 GMT

What you want is probably something like this. You want to do a recursive monitor. To be able to do this, you'll need a whitelist for it. I can't test it right now because I don't have any hosts stored as ip address file names. 😞

[monitor:///var/log/remote/.../*.log]
host_segment=4
sourcetype=bar
index=foo
whitelist = your ip address regex

Put in your IP address regex here, for example:

whitelist = (\/var\/log\/remote\/192\.168\.1.)

Depending on which IP addresses you want to monitor.

Skalli