Getting Data In

More than one DEST_KEY

Communicator

Can I use more than one DEST_KEY? For example

DEST_KEY=_MetaData:Index,MetaData:Sourcetype
FORMAT=sourcetype::VPN,index::authent

I currently have some VPN logs coming in through syslog that I would like to route to an index, and rename the sourcetype.

Tags (3)
0 Karma
1 Solution

Motivator

Motivator