topic syslog host transform base on event in Getting Data In

syslog host transform base on event

bambarit — Mon, 23 Nov 2020 06:00:39 GMT

I have syslog server and installed HF,

when send logs from HF to indexer, the host is represent base on Event host,

can we extract new field for HF hostname?

thambisetty — Thu, 19 Nov 2020 05:24:42 GMT

You can modify host value and you can have extra meta fields to hold information of hf if you wish to.

bambarit — Mon, 23 Nov 2020 02:17:29 GMT

do you mean host value in forwarder inputs?

vikramyadav — Mon, 23 Nov 2020 04:13:37 GMT

Yes you can change the name of host. Also you can extract new fields from HF.

-----------------------------------------

If this helps your like will be appreciated 🙂

bambarit — Mon, 23 Nov 2020 07:10:38 GMT

can we just use transform from indexer?

thambisetty — Mon, 23 Nov 2020 07:24:06 GMT

yes you can change on forwarder before you send logs to Indexer.