How to configure input.conf file to monitor multiple files from the same folder for multiple sourcetype.

[srujana96]

folder1 we have multiple file f1,f2,f3,f4 
need to configure all files for different sourcetype
below is the query which we have created but did not worked

[batch://<path_of the file>]
index=i1
sourcetype=s1
whitelist = f1
move_policy=sinkhole

[batch://<<path of the file>>]
index=i1
sourcetype=s2
whitelist = f2
move_policy=sinkhole

[gcusello]

Hi @srujana96,

you have two choices:

• using your solution: it's the easiest way,
• use only one soucetype and override on Indexers.

Anyway I hint your solution!

Why do you used batch? to ingest logs from a file, you should use monitor insterad batch in the stanza header.

Only one difference, instead to use whitelist option, put the filename in the stanza title, e.g.

[monitor://<path_of the file>/f1]
...

 Ciao.

Giuseppe