I'm writing an app where it has multiple sources that will be assigned to the sourcetype log4j. Searching for these logs for users is not straight forward because they need to search for something like "source=/full/app/path/*app.log*". Is there a way to tag at the source so instead the users could search for tag="appname" instead?
The tag is a search-time activity and can't be assigned in inputs.conf. I'm guessing a better option would be override the sourcetype to add the app name in the sourcetype itself so that you can search better (and it'll work with tstats command as well). Try like this