Getting Data In

extracting from logs before indexing to server

Path Finder

Hi

Is there a way to extract a part of log event before it being indexed to splunk server for example
Below is the entire event.

====================
{ActiveMQ Session Task} DEBUG LogCollector - start[1311770824360] time[474] tag[card;cardCreation;cardCreation End] host[hagrid.hyd.wc;127.0.0.1]
{ActiveMQ Session Task} DEBUG PerfLoggerDAOImpl - getting ServiceOperationInfo
Hibernate: select serviceope1_.id as id2_, serviceope1_.service_id as service2_2_, serviceope1_.operation_name as operation3_2_, serviceope1_.operation_descr as operation4_2_, serviceope1_.status as status2_ from service_info serviceinf0_, service_operation_info serviceope1_ where serviceope1_.service_id=serviceinf0_.id and serviceinf0_.name=? and serviceope1_.operation_name=?
Hibernate: select serviceinf0_.id as id1_0_, serviceinf0_.name as name1_0_, serviceinf0_.description as descript3_1_0_, serviceinf0_.type as type1_0_, serviceinf0_.status as status1_0_ from service_info serviceinf0_ where serviceinf0_.id=?
{ActiveMQ Session Task} DEBUG PerfLoggerDAOImpl - saving TaskExecutionInfo instance
=============

But I want only to see this "start[1311770824360] time[474] host[hagrid.hyd.wc;127.0.0.1]" in my indexer and the rest of part should be ignored. the filtering to be done on the client side only.
Is this possible.
Regards,
Harish

0 Karma

Path Finder

I am actually using splunk forwarder. Is it possible to specify in splunk forwarding config files or write some script to filter out the my application logs.

Regards,
Harish

0 Karma

Ultra Champion

I'm going to presume that your source application is using log4j as its logging framework(because activemq uses log4j) , therefore you could declare a seperate log4j appender in your log4j config file that outputs only the log data you want to send to the Splunk Indexer.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!