How to override the props source?

[coreyf311]

I have the below configured but source is not being over written. I am trying to wild card anything after Windows in the path.

props.conf

[source::/var/log/Windows/*]
TRANSFORMS-changesource=changesource

transforms.conf

[changesource]
FORMAT= source::WinEventLog:Security
DEST_KEY=MetaData:Source

I have it deployed to my heavy forwarder. It's not working there. I am also curious if I can deploy something like this to a Universal Forwarder after I am sure the syntax is correct?

[FrankVl · Accepted solution]

If you have further sub-directories behind /var/log/Windows/, you need to use the ... wildcard instead of *. So try [source::/var/log/Windows/...] instead.

And no, these operations cannot be done on UF. Unless this specific source value matches a specific inputs.conf stanza, then you could set the source field as part of the inputs.conf.

[coreyf311]

I would prefer to set source as part of the inputs.conf Can I override the source in inputs.conf?

[coreyf311]

the current sources are /var/log/LOGCENTRAL/Windows/hostname/hostname.log. This obviously varies as there are many hosts writing logs. My props is now [source::/var/log/LOGCENTRAL/Windows/...] and thats not working either.

[FrankVl]

I think you need to add a REGEX = . to your transforms.conf. That setting is required for index-time extractions like this. Sorry for not catching that earlier.

[FrankVl]

Yes, you can simply add source = WinEventLog:Security to the relevant inputs.conf stanza.

[coreyf311]

a simple read of the inputs.conf spec gave me the answer 🙂 Thanks!