Getting Data In

How to tag events based on the host value that contains a condition?

ReachDataScient
Explorer

Events from our DEV/PROD servers are ingested into the same index. This index already has events since 1 year.
The only way to distinguish the dev and prod events is if the host contains DEV or Prod in this value.
How can I tag the events based on the host value that contains a condition?

Thank you

1 Solution

woodcock
Esteemed Legend

You first set an eventtype with a name like dev_hosts and set it equal to host IN("foo*", "*-dev-*", "*etc") and then create a tag with a name of dev_hosts set to eventtype=dev_hosts.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You first set an eventtype with a name like dev_hosts and set it equal to host IN("foo*", "*-dev-*", "*etc") and then create a tag with a name of dev_hosts set to eventtype=dev_hosts.

View solution in original post

0 Karma

ReachDataScient
Explorer

Can you please list the steps to achieve what you suggested.

0 Karma

woodcock
Esteemed Legend

Settings -> Event types -> New Event Type
Be sure to set the Tag(s) settings.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!