How to route the logs from certain host to index=abc_secure?

[vijaysri]

Hi Team,

[host::1.(xx|xx).xx.xx(x|y)]
TRANSFORMS-change_index_abc_secure = change_index_abc_secure

[change_index_abc_secure]
SOURCE_KEY = MetaData:Index
REGEX = os, os_secure
DEST_KEY = MetaData:Index
FORMAT = index::abc_secure

I need to route the logs from certain host to index=abc_secure (not all the logs only os and os_secure logs)

[vijaysri · Accepted solution]

@gcusello 

Below config worked

Props

[host::LIANS*]
TRANSFORMS-change_index_abc_secure = change_index_abc_secure

Transforms.conf

[change_index_abc_secure]
SOURCE_KEY = _MetaData:Index
REGEX = os|os_secure
DEST_KEY = _MetaData:Index
FORMAT = abc_secure

[gcusello]

Hi @vijaysri,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[vijaysri]

Hi @gcusello 

Yes, this is fine, also I want the logs only from the hostname LIANS*

Will the below props and transforms work?

props.conf

[host=LIANS*]
TRANSFORMS-change_index_abc_secure = change_index_abc_secure

transforms.conf

[change_index_abc_secure]
SOURCE_KEY = MetaData:Index
REGEX = os|os_secure
DEST_KEY = MetaData:Index
FORMAT = index::abc_secure

[gcusello]

Hi @vijaysri,

yes it's correct, test it and tell me the result.

Ciao.

Giuseppe

[vijaysri]

Hi @gcusello 

This isn't working
Not sure where am I going wrong

[gcusello]

Hi @vijaysri,

please try this props.conf

[host::LIANS*]
TRANSFORMS-change_index_abc_secure = change_index_abc_secure

even if I'm not sure that's possible to use the asterisk in props.conf , could you try using a sourcetype instead host?

Ciao.

Giuseppe

[gcusello]

Hi @vijaysri,

if you want to redirect only logs where index contains os or os_secure you have to use a different regex:

[change_index_abc_secure]
SOURCE_KEY = MetaData:Index
REGEX = os|os_secure
DEST_KEY = MetaData:Index
FORMAT = index::abc_secure

Ciao.

Giuseppe