How to perform search among multiple instances based on instance name?

[cdavistt]

I run multiple instances of the same application on a server. Each instance generates its own set of log files, and I want to be able to perform searches based on the instance.

The log files are all located by the following path:

/var/log/myapp/instances//engine/engine*.log

I need a way to perform searches based on the instance name . The instance name is NOT contained in the log data, only in the file path.

If I wanted to usurp the "host" field, I could use the features of inputs.conf that allow me to extract the host from the file path. I am not sure this is a good solution for me, because I have multiple hosts doing this multiple instance thing and I would rather know the real host as well as the instance.

Any suggestions?

[aweitzman]

The file name should show up in the source field, so you might try something like this:

your-search-goes-here | rex field=source "/var/log/myapp/instances/(?<instance-name>\w+)/(.*)"

This should pull out your instance name into a field called instance-name that you can then work with.