Hi Everyone, I am using splunk forwarder and I have below requirements We have log files under path /opt/airflow/logs/*/*/*/*.log for example /opt/airflow/logs/getServerInfo/some_run_id/get_uptime/1.log or /opt/airflow/logs/build_upgrade/some_run_id/ami_snapshot_task/5.log Now i want to extract the field some_run_id from the log file path and want to add this some_run_id to each log line while sending the logs to splunk Below is my normal logs format [2024-01-17, 03:17:02 UTC] {subprocess.py:89} INFO - PLAY [Gather host information] [2024-01-17, 03:17:01 UTC] {taskinstance.py:1262} INFO - Executing <Task(BashOperator): get_os_info> on 2024-01-17 03:16:37+00:00 [2024-01-17, 03:17:01 UTC] {standard_task_runner.py:52} INFO - Started process 1081826 to run task Now i want below format of logs in splunk (I want this format of logs in splunk not on the actual log files) some_run_id [2024-01-17, 03:17:02 UTC] {subprocess.py:89} INFO - PLAY [Gather host information] some_run_id [2024-01-17, 03:17:01 UTC] {taskinstance.py:1262} INFO - Executing <Task(BashOperator): get_os_info> on 2024-01-17 03:16:37+00:00 some_run_id [2024-01-17, 03:17:01 UTC] {standard_task_runner.py:52} INFO - Started process 1081826 to run task Any help is much appreciated !
... View more
