Ok, so I'm not sure what I'm doing wrong here. I need to send data coming in on the standard syslog UDP 514 stream based on hostname (Most of it going to main, the rest going to a custom index).
i created a new props.conf in etc/system/local with just:
And a new transforms.conf with just:
My intention was to route anything coming in from 10.10.10.* to an index named test, however everything is still going to main.
What am I missing?
This is how you need to configure the transform:
and you could use the sourcetype or source in the props:
What happens if you change it to:
answered 22 Sep '10, 13:46
Really though, it seems to me his original solution should work as long as the incoming host name is in fact 10.10.10.*. I guess I would set the sourcetype to something not syslog (something that doesn't set the host) so you can see what's in the incoming data to be sure.
Oh, wait. Can you try:
And also as southeringtonp suggests, do not use the regex
I have same question I have 4 hosts 2 development and 2 production. I have created two index dev & prod.
I am using syslog TCP 514 port so how should i transfer production logs on prod and dev logs on dev index ?
I tried every combination but no luck... please help to find solution.
answered 10 Mar '11, 15:53