Hi All,
Is it possible to configure inputs.conf in such a way that universal forwarders running on different hosts can read the same file but scan a different set of directories? As an example, we want to create 1 inputs.conf with 3 stanzas . Now we want 3 different forwarders to read the same inputs.conf but monitor data from 1 directory each.
In other words, is it possible to link directory stanzas in inputs.conf with particular forwarders?
Our actual use case is given below:
We have a NFS mounted log directory having ~2000 subdirectories. We want to split the load across 4 universal forwarders with each forwarder scanning ~25% of the sub directories. We want to avoid managing 4 different inputs.conf files. Is that possible?
↧