Not sure why the hostname for the monitor stanza below is not being parsed out...
directory is as follows:
/mnt/log/files/2017/month/day/HOSTNAME/auth.logs
i would have thought by adding a stanza segment=7 will pull the following hostnames: servera, serverb, serverc... and so forth.
[monitor:///mnt/log/files/2017/03/(05|06|07|08|09)/.../auth.log.gz]
whitelist=servera|serverb|serverc|serverd|servere|serverf
segment=7
index=temp
sourcetype=nix:auth
Not sure what do I have to change here to get this to have the hostname, instead it is pulling the hostname for the local logserver.
Its called host_segment not segment...
from inputs.conf:
host_segment = <integer>
* If set to N, the Nth "/"-separated segment of the path is set as host. If
host_segment=3, for example, the third segment is used.
* If the value is not an integer or is less than 1, the default "host ="
setting is used.
* Defaults to unset.
@plumainwfs can you come back to this answer and let us know if it solves your problem by accepting an answer or adding more details?