Hello Everyone, I have an environment consisting of three VPC's (say x, y, and z). Each VPC holds Linux, Windows and AWS logs. I have successfully set-up the AWS log ingest using separate indexes (a...
See more...
Hello Everyone, I have an environment consisting of three VPC's (say x, y, and z). Each VPC holds Linux, Windows and AWS logs. I have successfully set-up the AWS log ingest using separate indexes (aws_vpcx, aws_vpcy, aws_vpcz). However, I'm struggling to get the Linux/Windows data to index the same way. The unique identifier I'm using is hostnames. The following holds true for all hostnames per VPC, VPC X has hostnames == vpcX*** VPC Y has hostnames == vpcY*** VPC Z has hostnames == vpcZ*** For Linux logs I tried to add the following : Inputs.conf currently has (index=os_vpcX) so the default is for all Linux hosts in VPC X which is why it's not in the props and transforms files below. Currently all VPCs are sending to the os_vpcX index instead of all three and I need to figure out why the below config isn't working. I'm doing this from the cluster master and pushing it to the indexer cluster. props.conf [host::vpcY*]
TRANSFORMS-osVpcY = osVpcYTrans
[host::vpcZ*]
TRANSFORMS-osVpcZ = osVpcZTrans transforms.conf [osVpcYTrans]
REGEX = vpcX.+
DEST_KEY = _MetaData:Index
FORMAT = os_vpcy
[osVpcZTrans]
REGEX = vpcY.+
DEST_KEY = _MetaData:Index
FORMAT = os_vpcz My second question is the same but for the Windows add-on..this seems more difficult with the single inputs.conf file having multiple indexes in it. Is there a way for me to specify more than one 'unique' thing about the stanza? For example, this is the default windows inputs.conf containing multiple indexes...I will need the windows index to go to either windows, windows_vpcY, or windows_vpcZ depending on the host that's sending the logs..but then I will also need that same separation for the wineventlog data (wineventlog, wineventlog_vpcY, wineventlog_vpcZ). ###### WinEventLog Inputs for DNS ######
[WinEventLog://DNS Server]
disabled = 0
renderXml=true
index = wineventlog
###### DHCP ######
[monitor://$WINDIR\System32\DHCP]
disabled = 0
whitelist = DhcpSrvLog*
crcSalt = <SOURCE>
sourcetype = DhcpSrvLog
index = windows Thanks in advance to anyone that can help!