What sourcetype should I use to index my mongo logs?

[abrie_strauss]

We currently have a mongodb cluster who's logs I would like to index to splunk, but there appears to be no sourcetype for mongo logs, what can be done to index the fields in a way that splunk registers the values at time of index?

[MuS]

Hi abrie.strauss,

take a look at this app Hunk App for MongoDB, maybe this can help.

cheers, MuS

[pcrook]

I think abrie.strauss is trying to solve the same problem that I am. I am trying to index mongodb.log files rather than analyze the data stored in Mongo itself. I don't think Hunk does that. Ideally, I'd like to say "splunk add monitor -source mongodb.log -sourcetype mongo" and Splunk would properly parse and present Mongo's log data. If Splunk doesn't have a sourcetype for Mongo logs, surely someone else has made one by now, no?