How to define clients for a server class based on installed Windows feature?

[paulcurry]

I have a use case where about 50% of my windows clients have IIS running on them.  I'd like to have a server class just for those 50% to ingest IIS logs.  I have IIS logs coming in but I have to manually list each client in the whitelist.  Is there a way to determine if a server has IIS, then deploy a specific server class?  I was thinking by an installed Windows Feature perhaps?  I'm at a loss.

[richgalloway]

Deployment servers are rather limited in how they can filter forwarders into classes.  Consider deploying the IIS input to all Windows servers.  Those servers without IIS installed will ignore the absent file(s).

[paulcurry]

That's probably the best plan.  However, say I have 15 normal IIS servers, 5 SFTP servers, and 5 SSRS servers.  All 25 run on IIS so the app the server class pushes out will go to one index.  But all 3 log types parse differently from an identical location.  This sounds like I would have to manually specify hosts for separate classes, right?

[richgalloway · Accepted solution]

In that case, yes, I think you'd have to manually specify host names for 3 separate server classes.