I added a sourcetype, weblogic_access_log
, with its customized field (wl_kv_and_fields
) in props.conf and transforms.conf. If I need to add another sourcetype e.g. tomcat_access_log with a different customized field e.g. tomcat_kv_and_fields
. How could I define it in transforms.conf? Hope I am understood. Thanks!
in props.conf
[weblogic_access_log]
REPORT-myfields = wl_kv_and_fields
in transforms.conf
DELIMS = "\t"
FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken
Hi shangshin
In your props.conf file you have "REPORT-myfields = wl_ kv_ and_ fields" so the stanza been referenced in transforms.conf has to be called "wl _kv _and _fields". For example
[wl_ kv_ and_fields]
DELIMS = "t"
FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken
You can reference this stanza for any amount of sources/sourcetypes provided you use the line "REPORT-myfields = wl_ kv_ and_fields"
Hi shangshin
In your props.conf file you have "REPORT-myfields = wl_ kv_ and_ fields" so the stanza been referenced in transforms.conf has to be called "wl _kv _and _fields". For example
[wl_ kv_ and_fields]
DELIMS = "t"
FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken
You can reference this stanza for any amount of sources/sourcetypes provided you use the line "REPORT-myfields = wl_ kv_ and_fields"
good answer. Thanks!