Getting Data In
Highlighted

How to monitor same log file into different sourcetypes by ip ?

Explorer

Hello,

I have logs from syslog server, my goal is to have events from the same log but these events will indexed with different sourcetype according to the IP in the log.
lets say I have a row in the log with IP X his sourcetype will be ST1
for IP Y the sourcetype will be ST2 and so on.

Here are my configurations

inputs.conf
[monitor://D:\KiwiDB]
disabled = false
index = db
it_syslog
sourcetype = transformsourcetype

props.conf
[transformsourcetype]
TRANSFORMS-transformsourcetype = changestbyIP1,changestbyIP2

transforms.conf
[changestbyIP1]
REGEX = "0.0.0.0"

FORMAT = sourcetype::cyberark:epv:cef
DEST
KEY = MetaData::Sourcetype

Thanks!
Hen

0 Karma