I believe the post you referenced still stands as the strongest approach. Use inputs.conf to collect the most generic pattern: monitor:///pathToLogs/*/fixedPath/logForSourcetype*.log (Notice the number is now wildcarded in the filename). And then use a sourcetype and host override to assign those fields dynamically depending on the source matches. - Override source types on a per-event basis - Set host values based on event data You may choose to assign the host and sourcetype to silly values as a way to ensure the health of this config. For example: [monitor:///pathToLogs/*/fixedPath/logForSourcetype*.log] host = changeMe sourcetype = changeMe And then you can have an alert for any events that appear with host=changeMe OR sourcetype=changeMe so you become aware when your configuration is failing. ... View more