Hi All,
I would like to know what is the best way to centralize rails productions logs across multiple server. So far I have gathered:
I'm using a universal forwarder to send the current production.log to the indexing server, but without properly understanding of the fields of the logs it gets all the data wrong.
What would you suggest to use to get data from universal forwarders into a readable format?
Thanks!
Justin
Use #1, you can control how field extractions occur. What sourcetype is being detected for your input? You may need to override it either in inputs.conf or props.conf on the forwarder. Then setup your own field extractions either with the UI or directly in props.conf doc here
Use #1, you can control how field extractions occur. What sourcetype is being detected for your input? You may need to override it either in inputs.conf or props.conf on the forwarder. Then setup your own field extractions either with the UI or directly in props.conf doc here