All Apps and Add-ons

Can I use custom sourcetype?

vikramyadav
Contributor

I have downloaded this application and the default source type which this app is using is "zyxel-fw". I want to use my own custom source type for Zyxel logs. Is it possible to do it?

abhishekkalokhe
Explorer

Yes, you can

This app is moduler, you just have to change the sourcetype entry from eventtypes. And you are good to go.
There is a link in Home page of app to change the configuration.

0 Karma

wwhite12
Path Finder

Short answer, yes, but it is not recommended. In downloaded apps, their pre-defined sourcetypes are usually defined multiple times throughout the app. Meaning, changing the sourcetype to your custom preference in one place(like props.conf) but not updating it in another (like inputs.conf) could lead to data not being parsed correctly.
If you absolutely want to change it to your custom sourcetype, you can go to the app in the CLI, update every stanza where a sourcetype is listed, and then perform a restart.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.