Some logs have timestamps in filename, some don't, combine into 1

[derekslenk]

Hello,

We are having problems with logging a certain file pattern, which is coming from Sitecore (shouldn't matter).

The first time in the day that the service is restarted/recycled, it creates a file like: log.20170502.txt

However, on subsequent restarts, it creates log files with timestamps, like: log.20170502.085920.txt

Is there any way to set up the forwarder to make it look like to the search heads/indexers that it all comes from log.txt?

Thanks in advanced.

[DalJeanis]

If each of those log files carries distinct data, then just set up your regex to catch all of them, with something like this...

log\.(\d+\.){0,2}txt

or

log\.\d+\.\d+?\.?txt

[derekslenk]

But what we are trying to do is have it show up as just log.txt in the search head, just for easing searching among files.