How can i rename more than one soucrtypes?
I have iis-2 iis-3 ...
Can this work?
[iis*]
rename=iis
See this on how to use wildcards in sourcetype stanzas.
Read the 2nd answer for a disclaimer
From there you should be able to do :
[(?:::){0}iis*]
sourcetype=iis