host_Regex help

[a212830]

Hi,

I want to name my host based upon a value in the logfile. I know it can be done via regex but it's not working.

The name of the files are like this...

SG_HTTP.AGW-US123-PLUG.140124.122345.log.gz
SG_HTTP.AGW-US301-PLUG.140124.122345.log.gz

my host regex is = (IGW+[a-zA-Z0-9_])

[somesoni2]

If AGW-US123-PLUG is the host name from the file name, use this

\.([-a-zA-Z0-9]+)\.

If just US123-PLUG is the host name , use this

-([-a-zA-Z0-9]+)\.

E.g. inputs.conf
[monitor://<path>]
host_regex = <your_regex>

[richgalloway · Accepted solution]

Assuming the host name is between the first two dots, this may work for you.

'rex "[.]*\.(?<host>[^.]+?)\.[.]*"'

[richgalloway]

Then you'll want to create a transforms.conf stanza with a 'REGEX = [.]*\.(?<host>[^\.]+?)\.(?<date>[^\.]*?)\.(?<time>[^\.]*?)' statement.

[a212830]

I'm looking to to this in the inputs.conf, not the search bar.