Issue with setting up my forwarders to Syslog servers

[jorgepinto1]

Hi,

I have the following setup on my heavy forwarder:

outputs.conf

[tcpout]
defaultGroup = default-autolb-group
indexAndForward = 0

[tcpout:default-autolb-group]
disabled = false
server = indexer1:9997,indexer2:9997

[syslog]
defaultGroup=nothing

[syslog:syslogGroup1]
server = server1:514

[syslog:syslogGroup2]
server=server2:53215

transform.conf

[send_to_syslog1]
REGEX = .*%ASA-\d+-(111008|106100).*
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup1

[send_to_syslog2]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup2

props.conf

[host::host1]
TRANSFORMS-host_! = send_to_syslog1

[host::hosts*]
TRANSFORMS-hosts = send_to_syslog2

This setup is not working, can someone help?

Regards

Jorge

[jorgepinto1 · Accepted solution]

Of course, the objective is to forward all the data to the indexers, the data from host1 that matches the regex specified to syslog1 and all the data from several hosts to syslog2

[alemarzu]

Hi there @Jorgepinto1

Can you try to specify the hostnames on the second stanza inside the props.conf to see what happens I believe that the current configuration is redundant. And also, be aware of the admiration sign ("!) on the first one.

[host::host1]
 TRANSFORMS-host_1 = send_to_syslog1

 [host::(host2|host3|host4)]
 TRANSFORMS-hosts = send_to_syslog2

Perhaps you mistyped it but make sure that your filename is called transforms.conf instead of transform.conf

[jorgepinto1]

This is the biggest oops I've posted here. Thank you very much Alemarzu.

Transform.conf vs transforms.conf

[alemarzu]

It happens sometimes. Glad we could solved it!