I need to index a file: /var/log/file.txt. This file runs every day, but sometimes the content doesn't change. This leaves me with no events on days that remain the same. I need it to index every time the timestamp changes on the file. I believe I need to add crcSalt =<SOURCE> to the inputs.conf in order to reindex it. However, my inputs monitors all files in /var/log. So if I add that to that input monitor, it would likely apply to all files in var log reindexing them all every time. Something I don't want. How can I reindex just this file daily while leaving the other files in the directory unchanged?
Many thanks
Create a separate inputs.conf stanza for /var/log/file.txt with crcSalt. Then blacklist file.txt from original /var/log monitoring stanza.
Create a separate inputs.conf stanza for /var/log/file.txt with crcSalt. Then blacklist file.txt from original /var/log monitoring stanza.