- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to differ input files in universal forwarder
mkrauss1
Explorer
07-28-2017
07:55 AM
I'm using the universal forwarder, assume i have following log files:
bar-20170728.log
andbar-20170728-foo.log
How would i setup inputs.conf to differ between the above logs.
Thats because i want to give them a different index and sourcetype.
Thx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sbbadri
Motivator
07-28-2017
08:03 AM
[monitor:///path/bar-*.log]
disabled=false
index=a
sourcetype=a
whitelist=bar\-\d+\.log$
[monitor:///path/bar-*.log]
disabled=false
index=b
sourcetype=b
whitelist=bar\-\d+\-foo\.log$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mkrauss1
Explorer
07-28-2017
08:39 AM
Thank you
![](/skins/images/89D5ADE867CBAF0B5A525B7E23D83D7E/responsive_peak/images/icon_anonymous_message.png)