I have several IIS servers forwarding over logs using the universal forwarder. I modified the inputs.conf on each server creating a custom sourcetype of servername_iislogs. The logs aren't parsing and I found out if I had set the sourcetype to IIS they would be. If these logs are already indexed will I have to delete and re-index them with the sourcetype set to IIS in order for them to be parsed correctly?
... View more