Hi,
I want to name my host based upon a value in the logfile. I know it can be done via regex but it's not working.
The name of the files are like this...
SG_HTTP.AGW-US123-PLUG.140124.122345.log.gz
SG_HTTP.AGW-US301-PLUG.140124.122345.log.gz
my host regex is = (IGW+[a-zA-Z0-9_])
Assuming the host name is between the first two dots, this may work for you.
'rex "[.]*\.(?<host>[^.]+?)\.[.]*"'
If AGW-US123-PLUG is the host name from the file name, use this
\.([-a-zA-Z0-9]+)\.
If just US123-PLUG is the host name , use this
-([-a-zA-Z0-9]+)\.
E.g. inputs.conf
[monitor://<path>]
host_regex = <your_regex>
Assuming the host name is between the first two dots, this may work for you.
'rex "[.]*\.(?<host>[^.]+?)\.[.]*"'
Then you'll want to create a transforms.conf stanza with a 'REGEX = [.]*\.(?<host>[^\.]+?)\.(?<date>[^\.]*?)\.(?<time>[^\.]*?)
' statement.
I'm looking to to this in the inputs.conf, not the search bar.