I am trying to filter a log file coming in via a universal forwarder (both installs are 4.2) so that messages containing text X go into index A with sourcetype A, messages with text Y go into index B with sourcetype B, everything else goes to index C with sourcetype C.
The following is inteded to pick out anything with "HostA" and direct it to index hosta_gen, then pick out anything with "HostA Nagios:" in it and send it to the hosta_nagios index, anything else should end up in hosta_cisco.
Thanks, it is simillar and I can get it to work to that extent. Data with "HostA nagios" does correctly go to the hosta_nagios index.
The difficulty I am having is applying 2 or more conditions to divide my incomming data to 3 indexes. Currently everything other than "HostA nagios" incorretly goes to the hosta_cisco index. I want to be able to fish out data with just "HostA" (and not "nagios") and put that in the hosta_gen index.