Foward specifc log file types to one index

[jbirchall1]

Is it possible to forward one type of log file to one type of index on the index.

The situation is that we have log file from different hosts stored on one central server and we would like to forward different types of log files to different indexes on the index, and have this so that if new hosts were added we wouldn't have to create new input stanza's.

What I thought might work was create this in the local/input.conf on the universal forwarder
Values in () have been replaced.

[default]

host = (host)

[monitor]:///(path to logs)/*/*.(logfile type)
index=(index name)
host=(\w+)\.(logfile type)$
followSymlink=false

                          both of these globs should be the same and be a host name 

[monitor:///(path to logs)//.(logfile type)]

[MuS]

Hi jbirchall

your inputs.conf should just work fine. no need to do this the complicated way like in my first answer 😉

cheers,
MuS

[jbirchall1]

Unfortunaelty the way I was trying it doesn't seem to work.

It works fine if I specify the full directory structure.

[MuS]

sorry for 'confusing' yourself...just rewrote my answer

[jbirchall1]

so the application would be the path ?
(path to logs)//.(logfile type)