We have a 3 index/3 search head cluster with master and deployment server.
I have a inputs.conf with
disabled = false
index = sample_services
But we keep getting the -too_small and the -2, -3 appended to new sourcetypes
there are 15 diff files being monitored under the Debug* I dont want to have to create a seperate stanza for every file they add ..
I just want it to make the sourcetype the name of the file.. not add anything on the end.
There is. You will need to specify this in your props/transforms files any where indexing is being performed.
TRANSFORMS-sourcetype_naming = dynamic_sourcetype_naming
DEST_KEY = MetaData::Sourcetype
SOURCE_KEY = MetaData::Source
REGEX = YOUR_REGEX_TO_PULL_THE_FILENAME
FORMAT = sourcetype::$1
WRITE_META = true