I have the below configured but source is not being over written. I am trying to wild card anything after Windows in the path.
props.conf
[source::/var/log/Windows/*]
TRANSFORMS-changesource=changesource
transforms.conf
[changesource]
FORMAT= source::WinEventLog:Security
DEST_KEY=MetaData:Source
I have it deployed to my heavy forwarder. It's not working there. I am also curious if I can deploy something like this to a Universal Forwarder after I am sure the syntax is correct?
If you have further sub-directories behind /var/log/Windows/
, you need to use the ...
wildcard instead of *
. So try [source::/var/log/Windows/...]
instead.
And no, these operations cannot be done on UF. Unless this specific source value matches a specific inputs.conf stanza, then you could set the source field as part of the inputs.conf.
If you have further sub-directories behind /var/log/Windows/
, you need to use the ...
wildcard instead of *
. So try [source::/var/log/Windows/...]
instead.
And no, these operations cannot be done on UF. Unless this specific source value matches a specific inputs.conf stanza, then you could set the source field as part of the inputs.conf.
I would prefer to set source as part of the inputs.conf Can I override the source in inputs.conf?
the current sources are /var/log/LOGCENTRAL/Windows/hostname/hostname.log. This obviously varies as there are many hosts writing logs. My props is now [source::/var/log/LOGCENTRAL/Windows/...] and thats not working either.
I think you need to add a REGEX = .
to your transforms.conf. That setting is required for index-time extractions like this. Sorry for not catching that earlier.
Yes, you can simply add source = WinEventLog:Security
to the relevant inputs.conf stanza.
a simple read of the inputs.conf spec gave me the answer 🙂 Thanks!