Getting Data In
Highlighted

Issue with setting up my forwarders to Syslog servers

Explorer

Hi,

I have the following setup on my heavy forwarder:

outputs.conf

[tcpout]
defaultGroup = default-autolb-group
indexAndForward = 0

[tcpout:default-autolb-group]
disabled = false
server = indexer1:9997,indexer2:9997

[syslog]
defaultGroup=nothing

[syslog:syslogGroup1]
server = server1:514

[syslog:syslogGroup2]
server=server2:53215

transform.conf

[send_to_syslog1]
REGEX = .*%ASA-\d+-(111008|106100).*
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup1

[send_to_syslog2]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup2

props.conf

[host::host1]
TRANSFORMS-host_! = send_to_syslog1

[host::hosts*]
TRANSFORMS-hosts = send_to_syslog2

This setup is not working, can someone help?

Regards

Jorge

0 Karma
Highlighted

Re: Issue with setting up my forwarders to Syslog servers

Explorer

Of course, the objective is to forward all the data to the indexers, the data from host1 that matches the regex specified to syslog1 and all the data from several hosts to syslog2

View solution in original post

0 Karma
Highlighted

Re: Issue with setting up my forwarders to Syslog servers

Motivator

Hi there @Jorgepinto1

Can you try to specify the hostnames on the second stanza inside the props.conf to see what happens I believe that the current configuration is redundant. And also, be aware of the admiration sign ("!) on the first one.

[host::host1]
 TRANSFORMS-host_1 = send_to_syslog1

 [host::(host2|host3|host4)]
 TRANSFORMS-hosts = send_to_syslog2

Perhaps you mistyped it but make sure that your filename is called transforms.conf instead of transform.conf

0 Karma
Highlighted

Re: Issue with setting up my forwarders to Syslog servers

Explorer

This is the biggest oops I've posted here. Thank you very much Alemarzu.

Transform.conf vs transforms.conf

0 Karma
Highlighted

Re: Issue with setting up my forwarders to Syslog servers

Motivator

It happens sometimes. Glad we could solved it!

0 Karma