Help indexs /etc/resolv as sourcetype config_file?

[daniel333]

All,

I need to monitor the /etc/resolv as sourcetype config_file in my env. This is well below the 256 byte min for CRC I am sure.

Larger files are working fine, but this is pretty small, 3 lines. It's coming in as hosts_too_small. I clearly have sourcetype set correct in inputs.conf and even tried setting it again with a tranform. But still comes in as "too small".

Any idea how I can get this file correctly indexed as sourcetype config_file?

[daniel333]

Just did this, and it worked. Seems like I am solving this wrong.

props.conf:

[(?::){0}*-too_small]
TRANSFORMS-remove_too_small = remove_too_small

transforms.conf:

[remove_too_small]
SOURCE_KEY = MetaData:Sourcetype
DEST_KEY = MetaData:Sourcetype
REGEX = sourcetype::(.*)-too_small
FORMAT = sourcetype::config_file