Hi all,
Our forwarders are adding meta data using inputs.conf
[default]
host = some.host.name
_meta = environment::testing site::somewhere
First question: how can I check if that data is actually correctly stored next to the event? Is there a search command that I could use to show only this metadata.
Second question: how can I check if that meta data is actually used during the search execution?
Thanks,
Pieter
I don't know if anyone still cares as this question was posted long ago but here is the answer:
If you want to use the meta fields in search you have to make them indexed fields.
To do this you need to make a change on the indexer.
In fields.conf add the following:
[environment]
indexed=true
[site]
indexed=true
After that you should be able to use 'environmnt=' in your search. And you should also see those two fields show up in the fields list.