Ingest Action configuration

[Baptiste]

Hello,

In the Ingest Action, can we cross-check by host rather than by sourcetype?

Regards

[livehybrid]

Hi @Baptiste 

The UI will only let you use a sourcetype for setting up Ingest Action, however you can update the props.conf to make it apply to a host instead e.g. take the following props.conf example:

[traefik:access:common]
RULESET-DropHECLog = _rule:DropHECLog:filter:regex:fyttbila
RULESET_DESC-DropHECLog = 

For host:

[host::yourHostName]
RULESET-DropHECLog = _rule:DropHECLog:filter:regex:fyttbila
RULESET_DESC-DropHECLog = 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing