Getting Data In

Syslog segregation and how pasing works when it is a syslog?

New Member

Is it possible to segregate the logs by redirecting everything to the routers via Syslog(other server Syslog to router log), then on the router(CentOS server) installing a light weight forwarder or a Heavy forwarder based on the load and bandwidth and get the logs to the Indexer.

If it is possible, how to Parse the data based on Hosts?

Tags (1)
0 Karma

Motivator

Actually the easiest is to filter host on the TCP or UDP directly in your inputs.conf,but make sure there is no inputs.conf for the port you will use (ie no [udp://514] or [tcp://514] stanza):

[udp://10.1.7.230:514]
sourcetype = my-sourcetype

[udp://10.1.7.232:514]
sourcetype = my-sourcetype

OR

[tcp://10.1.8.28:514]
sourcetype = my-sourcetype2

[tcp://10.1.8.30:514]
sourcetype = my-sourcetype2
0 Karma