I'd like to create a custom name for a common sourcetype. For instance:
[monitor:///my/special/directory]
sourcetype = custom_syslog
[custom_syslog]
[source::/my/special/directory]
sourcetype = custom_syslog
Rename does this in the reverse. I could rename my custom field to syslog with 'rename = syslog' in my props.conf, but that wouldn't help me. I want the behavior, but not the name of the default sourcetypes.
I am not sure to understand perfectly what you try to do. To me it seems impossible to change de behavior since its linked to a specific set of data. It will always behave as it was doing at the begining
Please if this is not enought, provide more details