We've about 20 universal forwarders monitoring different log files. Our system doesn't allow to use heavy forwarders because of their performance impact on data indexing.
These universal forwarders send their data to a couple of indexers.
I've read Route and filter data docu (Discard specific events and keep the rest section). My question is that as we have different source log files located on different boxes, how would I refer them in props.conf file:
For example, on one box I monitor /log/log.1 and on another /log/log.2.
Should I point the hostname after the source:: as well? Could somebody show an example?