Can a phyton script modify a log event on the fly in a universal forwarder?
For example:
file.log:
timestamp <id=xxxx>{
json content
}
log event to be forwarded:
file.log:
{
"timestamp : "xx/xx/xx:xx:xx:xx",
"id" : "xxxx"
json content
}
Thanks for your guidance.
LP
This cannot be done at the Universal Forwarder. I'm not even sure it can be (simply) done at the indexer.