I have overridden the source values from the default log file path to custom names like "AppLog", "MaintenanceLog", etc, through input.conf:
[monitor://F:\LOGS]
...
source = AppLogs
...
Is there a way to retrieve the original value of the source, F:\LOGS\my_original_log_file_name.log ?
Thanks in advance!
No AFAIK this is only possible for the sourcetype field where the original can be retrieved with the _sourcetype field.
No AFAIK this is only possible for the sourcetype field where the original can be retrieved with the _sourcetype field.
I was afraid that's the case too. Thanks for confirming ziegfried.