All,
I have a dozen+ inputs I am creating. I feel there there should be a smarter way of doing this. As you can see, I am naming the sourcetype after the log.
[monitor:///opt/paidsearch/autopilot/logs/collateral.log]
index=paidsearch
sourcetype=paidsearch:collateral
[monitor:///opt/paidsearch/autopilot/logs/partner.log]
index=paidsearch
sourcetype=paidsearch:partner
↧