I run multiple instances of the same application on a server. Each instance generates its own set of log files, and I want to be able to perform searches based on the instance.
The log files are all located by the following path:
/var/log/myapp/instances/
I need a way to perform searches based on the instance name
If I wanted to usurp the "host" field, I could use the features of inputs.conf that allow me to extract the host from the file path. I am not sure this is a good solution for me, because I have multiple hosts doing this multiple instance thing and I would rather know the real host as well as the instance.
Any suggestions?
The file name should show up in the source
field, so you might try something like this:
your-search-goes-here | rex field=source "/var/log/myapp/instances/(?<instance-name>\w+)/(.*)"
This should pull out your instance name into a field called instance-name
that you can then work with.