Specifying a catch-all in inputs.conf?

mickeander — Mon, 26 Oct 2020 13:11:22 GMT

Hi,

If i have a directory structure like this:

/logs/server1

/logs/server2

/logs/server3

And i have set specific inputs.conf stanzas for server 1,2 and 3, but i also want to catch everything that ends up in /logs/, could i set the server1-3 stanzas and have a catch all stanza, or will that catch all stanza collect the logs from server 1-3 again?

[monitor:///logs/server1] host_segment = 2 index = foo sourcetype = aaa [monitor:///logs/server3] host_segment = 2 index = bar sourcetype = bbb [monitor:///logs/server3] host_segment = 2 index = baz sourcetype = ccc [monitor:///logs] index = unknown

topic Specifying a catch-all in inputs.conf? in Getting Data In

Specifying a catch-all in inputs.conf?