Is it possible to define custom fields and hard-code their values on a per-forwarder basis?
I'm looking to use such a feature to define a custom field for server "environment" that will be hard-coded on each forwarder. For example, a group of nodes will be part of a QA1 environment and another will belong to QA2. On the forwarders for these nodes I want to be able to hard-code the "QA1" and "QA2" values to support searches that filter on the environment.
I'm not sure this is possible with props.conf and transforms.conf since the values are not present in actual log messages.
... View more