I'm looking to insert some text at our heavy forwarder into certain sourcetypes that a 3rd party running syslog-ng will see and be able to better identify what the logs are. For example, "IISLog", or "DHCPLog". Does anyone have any experience doing this?
We are sending them the logs from a heavy forwarder using syslog output. I was looking into potentially using SEDCMD within a props.conf file, but I'm not too experienced with doing this, and just getting started with RegEx.