Hi All,
We are sending logs to a third party system.
And in the inputs.conf monitor stanza, we have set:
sendCookedData = false
sourcetype = errorlogs
index = logs_index
**sendCookedData = false** because we are forwarding logs to a third party system.. (Mentioned in doc)
Also, we have set the sourcetype and specified an index..
Can we read the sourcetype set for the data at the receiving end?
For now we are able to see only the plain loglines.
Appreciate any help!
Thanks
↧