I have the following setup on my heavy forwarder:
outputs.conf [tcpout] defaultGroup = default-autolb-group indexAndForward = 0 [tcpout:default-autolb-group] disabled = false server = indexer1:9997,indexer2:9997 [syslog] defaultGroup=nothing [syslog:syslogGroup1] server = server1:514 [syslog:syslogGroup2] server=server2:53215 transform.conf [send_to_syslog1] REGEX = .*%ASA-\d+-(111008|106100).* DEST_KEY = _SYSLOG_ROUTING FORMAT = syslogGroup1 [send_to_syslog2] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = syslogGroup2 props.conf [host::host1] TRANSFORMS-host_! = send_to_syslog1 [host::hosts*] TRANSFORMS-hosts = send_to_syslog2
This setup is not working, can someone help?
Of course, the objective is to forward all the data to the indexers, the data from host1 that matches the regex specified to syslog1 and all the data from several hosts to syslog2
Hi there @Jorgepinto1
Can you try to specify the hostnames on the second stanza inside the props.conf to see what happens I believe that the current configuration is redundant. And also, be aware of the admiration sign ("!) on the first one.
[host::host1] TRANSFORMS-host_1 = send_to_syslog1 [host::(host2|host3|host4)] TRANSFORMS-hosts = send_to_syslog2
Perhaps you mistyped it but make sure that your filename is called
transforms.conf instead of transform.conf
This is the biggest oops I've posted here. Thank you very much Alemarzu.
Transform.conf vs transforms.conf