Unable to get day value padding to work via the props.conf. The log file looks as follows:
Jul 5 20:51:28 abcdenc06 lost page write due to I/O error on dm-1
The source has multiple names in the 4th directory source="/var/log/rmtlogs/abcde/systems.log"
or could be source="/var/log/rmtlogs/fghij/systems.log"
.
My props.conf file is defined as:
[source::/var/log/rmtlogs/*/systems.log
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TIME_FORMAT = %b %e %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 16
It is cumbersome to use source
for any props.conf
stanza header; almost always we use sourcetype
. I suggest that you change your stanza header to use the sourcetype
that you set in your inputs.conf
for these files, even if it is 2 different sourcetypes. If you mist keep this as-is, then be sure to add a ]
character to the end of your stanza header line (it is missing).