Can I apply masking at host level instead of sourcetype?

[abi2023]

I want mask some data coming from web server logs particularly only one server out of all my web server logs. Can I apply my masking rule to only one my webserver  source instead of all my web server sending to the same sourcetype?

If I apply this rule to all web server log it will be high resource usage at my indexer?

Thanks

[PickleRick]

https://docs.splunk.com/Documentation/Splunk/Latest/Admin/Propsconf

[<spec>]
* This stanza enables properties for a given <spec>.
* A props.conf file can contain multiple stanzas for any number of
  different <spec>.
* Follow this stanza name with any number of the following setting/value
  pairs, as appropriate for what you want to do.
* If you do not set a setting for a given <spec>, the default is used.

<spec> can be:
1. <sourcetype>, the source type of an event.
2. host::<host>, where <host> is the host, or host-matching pattern, for an
                 event.
3. source::<source>, where <source> is the source, or source-matching
                     pattern, for an event.
4. rule::<rulename>, where <rulename> is a unique name of a source type
                     classification rule.
5. delayedrule::<rulename>, where <rulename> is a unique name of a delayed
                            source type classification rule.
                            These are only considered as a last resort
                            before generating a new source type based on the
                            source seen.

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

Thereis one caveat - it applies to the original sourcetype/source/host values the data is ingested with. If your props overwrite thise values (for example by "splitting" single sourcetype to multiple more specific ones or rewrite source/sourcetype as happens with some windows logs, especially read from ForwardedEvents), the new values don't affect event processing in ingest pipeline.