I want to rename an 'old' sourcetype (access:mwp) into a new one (access:web:mwp). Does this work in my props.conf:
["access:mwp"]
rename=access:web:mwp
["access:web:mwp"]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=50
TIME_FORMAT=%b %d, %Y %H:%M:%S %P
No, you should not use quotes in the stanzas. Other than that, your renaming looks OK.
No, you should not use quotes in the stanzas. Other than that, your renaming looks OK.