Hi All, Can any one guide me on how to blacklist two different host in the same inputs.conf files in Heavy Forwarder (HF) instance?
Currently we have the below inputs.conf set and in which we have already blacklisted a host but I want to add another host along with the below host, so that the logs from this host are not indexed in the same indexer.
example: want to blacklist sep01 logs from this path /opt/syslogs/generic/sep01/Sep01.log in the below inputs.conf
[monitor:///opt/syslogs/generic/.../*.log]
sourcetype = syslog
host_segment = 4
blacklist = dxx*lxx*
index=unix_svrs
Kindly guide me on this to fix this problem.
thanks in advance.
↧