topic Re: HOw to black list entire folder in Getting Data In

HOw to black list entire folder

vikas_gopal — Tue, 03 Mar 2020 23:17:06 GMT

HI Experts ,

I am prety sure this has been already answered but I am not able to find the correct answer on the community . I have path as below
C:\app1\tomcatlogs1\WNSalesLogs1\WNEngine1\
server1
server2
server3

I have 8 servers on which same directory structure exist

I want to use host_segment so that my host name will be automatically picked up and I only want to index server1 files . So 2 things I want to achieve
1) If I am on host 1 , the host name should be server1

2) Only server1 folder files will get indexed .

I tried folloing but it is not indexing my files and not setting up the hostname

[monitor://C:\app1\tomcatlogs1\WNSalesLogs1\WNEngine1\*\productengin_*.log]
disabled = false
host_segment = 5
index = main
whitelist = server1

Any suggestion will be highly appricaited

Regards
VG

Re: HOw to black list entire folder

jkat54 — Tue, 03 Mar 2020 23:24:17 GMT

Can you do this?

[monitor://C:\app1\tomcatlogs1\WNSalesLogs1\WNEngine1\server1\productengin_*.log]
 host=server1
 index=main

Re: HOw to black list entire folder

vikas_gopal — Tue, 03 Mar 2020 23:48:41 GMT

My bad I don't know after posting my format of the inputs.conf file is disturbed let me modify it .Please check now , hope this make sense . Here first * is folder like server1, server2, etc . Wild car in the file name , I am not bothered about that , because it is just 1,2 ,3 etc

Re: HOw to black list entire folder

jkat54 — Wed, 04 Mar 2020 00:16:06 GMT

I've updated

Re: HOw to black list entire folder

vikas_gopal — Wed, 04 Mar 2020 00:21:13 GMT

Thank you for the quick response but the only concern is via DS how I can manage this as a single stenza . That is why I was planing to use host_segment . So does this mean I have to create sepparate app per host ?

Re: HOw to black list entire folder

vikas_gopal — Wed, 04 Mar 2020 03:13:57 GMT

Well I have created separate SC and App on DS for each host.

Re: HOw to black list entire folder

jkat54 — Wed, 04 Mar 2020 07:46:21 GMT

The way you wanted to do this is possible, but you need props & transforms.

props.conf
[sourcetype]
TRANSFORMS-abc=abc

transforms.conf
[abc]
REGEX=WNEngin1\/(\W+)\/
 SOURCE=MetaData:Source
FORMAT=host::$1
DEST=MetaData:Host