Inputs hierarchy

[fdesterke]

Hello,

I want to monitor a directory but within that directory is another directory which I want to index under a different Source Type.

specifcally:
[monitor:///var/log/*]
sourcetype syslog

and the subfolder
monitor:///var/log/apache2/*
sourcetype apache_error

But the second input falls under the first, and since data isn't indexed twice, I'm wondering how splunk is going to handle this.
Will it just index the apache logs with the first rule with sourcetype syslog. Or is splunk smart enough to index the apache logs with the sourcetype apache_error if i define the second input like that.
Or do I put the apache data input before the other one?
Or do I blacklist the folder in the first input rule, if so, how?

[richgalloway]

Use a blacklist within the first stanza to avoid indexing the Apache logs as syslog.

[monitor:///var/log/*]
sourcetype = syslog
# blacklist uses a regular expression, not a pattern
blacklist = (.*apache2.*)

[monitor:///var/log/apache2/*]
sourcetype = apache_error