syslog host transform base on event

[bambarit]

I have syslog server and installed HF,

when send logs from HF to indexer, the host is represent base on Event host,

can we extract new field for HF hostname?

[vikramyadav]

Hi @bambarit 

Yes you can change the name of host. Also you can extract new fields from HF.

-----------------------------------------

If this helps your like will be appreciated 🙂

[bambarit]

can we just use transform from indexer?

[thambisetty]

You can modify host value and you can have extra meta fields to hold information of hf if you wish to.

[bambarit]

do you mean host value in forwarder inputs?

[thambisetty · Accepted solution]

@bambarit 

yes you can change on forwarder before you send logs to Indexer.