hello,  sendemail can not work variable fields. example,     index=mail | table id domain | eval email=id."@abc.com" | sendemail to="$email$" subject="test" sendresult=true inline=true message="test"     >> command="sendemail", {} while sending mail to:       index=_internal email     >> ERROR sending email. subject="test", results_line="None", recipients="[]", server="localhost"   why can't I identify my email address? it works normally when i enter email address.   ... View more

Hello, I am trying to access DB using latin1 character as DB connector. However, the text is not output normally. I tried the following through JDBC URL in DB connection, but still no normal output. jdbc:mysql://<ip>:<port>/<database>?characterEncoding=latin1 jdbc:mysql://<ip>:<port>/<database>?useUnicode=true&characterEncoding=latin1 jdbc:mysql://<ip>:<port>/<database>?useUnicode=true&characterEncoding=utf8 jdbc:mysql://<ip>:<port>/<database>?useUnicode=yes&characterEncoding=UTF-8 could you help me?   MySQL version: 5.1 ... View more

I have a problem with parsing, so I want to change the sourcetype. ex) index=A sourcetype=A  →  index=A sourcetype=B I am using forwarder and restarted after changing sourcetype in inputs.conf. However, the log flows into the existing sourcetype. How can I solve it? ... View more

I want to use forwarder to forward mail logs to indexer. However, the log forwarded from the forwarder is displayed separately from the indexer. how can i solve it. start character: MAIL_LOG end character: END_MAIL [[[forwarder log file]]] ex1) The forwarder log file looks like this: MAIL_LOG date:2019-00-00 00:00:00 subject: abcdefg from: abc@abc.com to:abcd@abcd.com size:12345 content:afafa ... END_MAIL [[[indexer]]] The log is divided. ex1) only mail start characters logs. MAIL_LOG ex2) only part of the message logs. content:afafa ex3) Do not include the mail start character logs. MAIL_LOG date:2019-00-00 00:00:00 subject: abcdefg from: abc@abc.com to:abcd@abcd.com size:12345 ... View more