I have overrided some souretypes out of a huge syslog feed ( Kiwisyslog) Now I want to route specific sourcetypes to other indexes,,is this possible?
props.conf
[syslog]
TRANSFORMS-sourcetype_and_host_override = asa_hostoverride, cisco_asa, cisco_fwsm
SHOULD_LINEMERGE = false
[cisco_firewall]
TRANSFORMS-index = route_2_other_index
transforms.conf
[asa_hostoverride]
DEST_KEY = MetaData:Host
REGEX = \S+\t\S+\s(.*)\t+
FORMAT = host::$1
[cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = (%ASA)
FORMAT = sourcetype::cisco_firewall
[cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = (%FWSM)
FORMAT = sourcetype::cisco_firewall
[route_2_other_index]
REGEX = (.)
DEST_KEY = _MetaData:Index
FORMAT other_index
Thanks!
As Gkanapathy mentioned : I took the whole bunch onder the same master sourcetype : below for a single entry ( [cisco_asa_2_index] ) ,,,but this works for all my sourcetypes in syslog!
[syslog]
TRANSFORMS-sourcetype_and_host_override = asa_hostoverride, cisco_asa, cisco_fwsm, named, dhcp, cisco_asa_2_index
SHOULD_LINEMERGE = false
transforms.conf
[asa_hostoverride]
DEST_KEY = MetaData:Host
REGEX = \S+\t\S+\s(.*)\t+
FORMAT = host::$1
[cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = (%ASA)
FORMAT = sourcetype::cisco_firewall
[cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = (%FWSM)
FORMAT = sourcetype::cisco_firewall
[cisco_asa_2_index]
DEST_KEY = _MetaData:Index
REGEX = (%ASA)
FORMAT = other_index
Not the way you have done it. Transforms only happen in a single pass, so the [cisco_firewall]
rule in props.conf will not apply, since the events have not had their sourcetype set to cisco_firewall
yet. You would have to add another rule on [syslog]
to match and set the index.
so how do I add the cisco_firewall in other index?
Not sure what you mean though