input.conf concat host to host_regex value

[stephend]

Hi trying to work out if I can prefix the value returned by host_regex with the actual server name as some of the logs do not identify which server they came from.

I am currently using host_regex to extract the host name from the log path, but that only works for some logs, other have no way to identify the host.

So looking to combine host + host_regex values.

Thanks.

[lguinn2]

AFAIK, you can't do that, but here are a few other ideas:

1) On the forwarder, set the host in props.conf for the specific logs with problems.

2) On the indexer, use props.conf plus transforms.conf to set the host to whatever you want...

Here is some documentation from the Getting Data In manual that talks About hosts