Add 'static' field to all events from a source (syslogs)

[tskimball]

I have a dedicated index for syslogs that I would like to add a 'static field' to:

MonFunc=sysmsgs ### Add to all events in this index

I'm trying to merge this data with related info in another logging index (which has a field extract for various function errors, generating the MonFunc). But, doing an aggregate table-based summary (from all indexes), grouped by MonFunc, has all the syslogs showing up as NULL.

I know of one possible workaround (our monitor system has its own filter and log, adding its own msg before the actual syslog), but would prefer a 'simpler' solution than generating a custom syslog extractor. It would also end up bypassing other data that may be useful long-term, which I'm trying to avoid.

[davecroto]

Devise a common sourcetype

example lookup csv called myexample.csv

sourcetype,SLA,NAME,VALUE
foobar,99,TechnicalError,456

transforms.conf:

[myexamplelookup]
filename=myexample.csv

props.conf
[foobar]
LOOKUP-myexamplelookup = myexamplelookup sourcetype VALUE OUTPUT SLA NAME VALUE

[tskimball]

This is for adding an (already defined) field that shows what function the message came from.

In the case of our monitoring app, all syslogs come from a function named 'sysmsgs.' Setting that field for all incoming syslogs will help prevent confusion for our end users.

[hazekamp · Accepted solution]

To add a static kv pair to all events in an index I would recommend using a lookup table to map index->MonFunc. The trick is to use a global (no stanza) property unless you can scope to a particular source/sourcetype/host. I didn't find the name of your index, so be sure to change "index_name" to reflect the name of the index you want to assign the kv pair to:

## MonFunc.csv
index,MonFunc
index_name,sysmsgs

## transforms.conf
[MonFunc_lookup]
filename = MonFunc.csv

## props.conf
LOOKUP-MonFunc_for_index_name = MonFunc_lookup index OUTPUT MonFunc

[tskimball]

Excellent, that worked. Thanks.

[netwrkr]

Are you simply trying to insert a placeholder field which will be later defined by other query?