So you are saying I should do something like this
[monitor:////data/X/logs/.../A*.log]
index = my_index
sourcetype = product.a.log
and that this will track A because the CRC of the header in old A.log and in A+date.log will be the same and so will notice extra entries appended t the bottom if they don't match? Is there a way to change the size of the CRC header size? The is a lot of xml being logged and it could be that the last 256 do not change between messages (though the file size will)
... View more