OK to specify host on each log line instead on path?

[Justin_Grant]

I have a log, representing data from multiple hosts, with lines like this:

7/30/2010 4:11:52 PM host=OAK06VMH load=52

The UI for configuring file inputs in Manager has a choice to pull the hostname from the file path, but there doesn't seem to be an option in the UI for setting the host based on the log data itself. Am I missing something? Is this something I have to dig into the config files to support, and if so what props/trandform config file changes do I need?

[gkanapathy · Accepted solution]

per-event host settings (as with any per-event field extractions and transformations) need to be set by a transforms.conf or props.conf stanza. For setting the host field, it must be done where parsing occurs, and triggered by a props.conf stanza that is based on source, sourcetype, or host. For an example that does something similar to what you want, look at the default (etc/system/default) props.conf rule for [syslog], which invokes the transforms.conf stanza [syslog-host]. You will also find that something like this occurs on all [WMI:*] source type inputs.

Please be aware that there is a cost at indexing/parsing time to doing a transformation on every incoming line. If you can instead specify this field values in inputs.conf for the entire input, this cost can be avoided. If your regular expression for extracting the host is efficient, the cost will probably be negligible.