diff --git a/package/etc/conf.d/destinations/splunk_hec_debug.conf b/package/etc/conf.d/destinations/splunk_hec_debug.conf index e5e6714..795757b 100644 --- a/package/etc/conf.d/destinations/splunk_hec_debug.conf +++ b/package/etc/conf.d/destinations/splunk_hec_debug.conf @@ -1,5 +1,5 @@ destination d_hec_debug { - file("/opt/syslog-ng/var/archive/${.splunk.sourcetype}/${HOST}/$YEAR-$MONTH-$DAY-message.log" + file("/opt/syslog-ng/var/archive/debug/${.splunk.sourcetype}/${HOST}/$YEAR-$MONTH-$DAY-message.log" template("curl -k -u \"sc4s HEC debug:$(env SPLUNK_HEC_TOKEN)\" \"$(env SPLUNK_HEC_URL)\" -d '$(format-json time=$S_UNIXTIME.$S_MSEC host=${HOST} @@ -8,7 +8,6 @@ destination d_hec_debug { index=${.splunk.index} event=$MSG fields.*)'\n") -# file("/var/log/messages_syslog" create_dirs(yes) ); };