I have troubles asigning sourcetypes for multiple filetypes in one directory. I have read a few posts which talk about the same problem, but I don't get the right solution to get it work
I have a directroy with two filetypes servername_app1_timestamp.log and servername_app2_timestamp.log
Now I want to asign servername_app1_.... the sourcetype app1 ans so on.
This is my inputs.conf on the forwarder
and this the props.conf from the indexer
We use version 4.1.4. Do you have a clue whats going wrong
My solution was the following
I have only configured the forwarder (not a lightweightforwarder) If I understand it right, than a normal forwarder made the parsing of the messages before he sends the data to the indexer and so I can configure the props.conf on the forwarder.
answered 03 Aug '10, 09:19
Since you are manually setting the sourcetype anyway, try setting it at the input rather than via props.conf. Monitor works for Files or Directories.
You should be able to have two inputs:
And no need for the props.conf entries.
answered 30 Jul '10, 19:51