LM Logs multiple capture group parsing

At least you can get lmlogs to work lol… we (myself and now three support guys) have yet to get it working.

I’ve taken a step back and just made on lmlog source that applies to one resource and told to map HOSTNAME to system.sysname which is identical to what’s in the collector configuration… lmlog source is supposed to take precedence over the collector configuration but so far it doesn’t look that way.

#1
I don’t suppose you’d be willing to share all of the lines you have in your collector configuration with the word “lmlog” or “syslog”

#2
What does your resource mapping look like in your lmlog source ?

#3 I am very interested in the multiple capture group but their documentation is lacking, would you be able to post an example of that ? :)

Thank you !!!