Here are the steps to achieve it,
Create props.conf to override sourcettype and index. Sourcetype can not be specified under host stanza as you put above in props.conf.
Assume you are using automatic sourcetyping of the the syslog
props.conf
[host::192.168.17.3]
TRANSFORMS-0force_index_sourcetype = 0force_index, 0force_sourcetype
[host::192.168.17.4]
TRANSFORMS=1force_index_sourcetype = 1force_index, 1force_sourcetype
transforms.conf
assign abc index
[0force_index]
SOURCE_KEY=MetaData:Host
REGEX=^192.168.17.3$
DEST_KEY=_MetaData:Index
FORMAT=abc
assign abc sourcetype
[1force_sourcetype]
SOURCE_KEY=MetaData:Host
REGEX=^192.168.17.3$
DEST_KEY=MetaData:Sourcetype
FORMAT=abc
I have not tested this.
... View more