topic Re: forwarder logs different type from the indexer. in Getting Data In

forwarder logs different type from the indexer.

lifekis — Wed, 30 Sep 2020 02:56:22 GMT

I want to use forwarder to forward mail logs to indexer.
However, the log forwarded from the forwarder is displayed separately from the indexer.
how can i solve it.

start character: MAIL_LOG
end character: END_MAIL

[[[forwarder log file]]]
ex1) The forwarder log file looks like this:
MAIL_LOG
date:2019-00-00 00:00:00
subject: abcdefg
from: abc@abc.com
to:abcd@abcd.com
size:12345
content:afafa
...
END_MAIL

[[[indexer]]]
The log is divided.

ex1) only mail start characters logs.
MAIL_LOG

ex2) only part of the message logs.
content:afafa

ex3) Do not include the mail start character logs. MAIL_LOG
date:2019-00-00 00:00:00
subject: abcdefg
from: abc@abc.com
to:abcd@abcd.com
size:12345

Re: forwarder logs different type from the indexer.

richgalloway — Tue, 12 Nov 2019 03:01:50 GMT

Please explain more about what you mean by "the log forwarded from the forwarder is displayed separately from the indexer". Use actual example events, but hide private information.

Re: forwarder logs different type from the indexer.

lifekis — Tue, 12 Nov 2019 04:26:09 GMT

The forwarder can check the log file in full format. However, the log is truncated on the indexer.

Re: forwarder logs different type from the indexer.

gaurav_maniar — Tue, 12 Nov 2019 11:05:33 GMT

provide the screenshot of the log file and the same data in Splunk.
I think, the issue is because of sourcetype configuration for multiline event.

Re: forwarder logs different type from the indexer.

richgalloway — Tue, 12 Nov 2019 11:29:22 GMT

Your props.conf settings probably need to be adjusted. Please provide some sample events and we'll try to help you get the settings right.