For hosts that are not using local time either on the system or in particular applications, I use a heavy forwarder on them and set the time zone in props.conf, which I push out via Deployment Server alone with inputs.conf. Here is one props.conf entry:
[mswin_2008r2_iisw3c-ews] TZ = GMT TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ MAX_TIMESTAMP_LOOKAHEAD = 25
This works just fine.
So, based on the comment you want to set a TZ for a specific host for a certain sourcetype.
This is un-tested so I'm not sure if it will work, but this is what you can try.
[YourSourceType] TRANSFORMS-001_YourSourceType_set_TimeZone = YourSourceType_set_TimeZone
[YourSourceType_set_TimeZone] SOURCE_KEY = MetaData:Host REGEX = MyServerNameToSetTZ DEST_KEY = MetaData:TZ FORMAT = UTC
This will use the transform on
YourSourceType and the
REGEX should match the hostname. The
DEST_KEY sets what will be re-written and the
FORMAT will be the new value used in this field.
Hope this makes sense and helps ...
We use the same sourcetype for the same log format, but we have some which have not specified the timezone in their logs and so we need to do this in props.conf, but I'd need to be able to specify the host.
I'd like to keep the sourcetype the same as everything else about the structure is the same.
I can't just specify the host, as there are other sourcetypes in that host which I don't want to effect.