I am using universal forwarder.
I wish to tag my logs with the application and some custom information like groupA or groupB etc. So, I wish to have multiple tags to my events namely applog1, groupA.
I understand we can do it from _meta in inputs.conf. But, that does not seem to work. In fact, once I add a tag, none of the events are shown in search.
Is there any other way to do that ? Any pointers will help.
Thanks and Regards,
Abhay Dandekar
↧