Hello,
I have logs from syslog server, my goal is to have events from the same log but these events will indexed with different sourcetype according to the IP in the log.
lets say I have a row in the log with IP X his sourcetype will be ST1
for IP Y the sourcetype will be ST2 and so on.
Here are my configurations
inputs.conf
[monitor://D:\Kiwi_DB]
disabled = false
index = db_it_syslog
sourcetype = transformsourcetype
props.conf
[transformsourcetype]
TRANSFORMS-transformsourcetype = change_st_by_IP1,change_st_by_IP2
transforms.conf
[change_st_by_IP1]
REGEX = "0.0.0.0"
FORMAT = sourcetype::cyberark:epv:cef
DEST_KEY = MetaData::Sourcetype
Thanks!
Hen
