Each destination can be configured to forward only particular events. The default behaviour for each destination depends on the first filter.
...
| Info | ||
|---|---|---|
| ||
Snare agents transmit the hostname as the first element of the event, followed by a tab. Some options to capture 'myhostname' are shown below. Which option you use, will depend on the format your log source uses to send through events. ^myhostname\t ^myhostname(\.mydomain)\t ^([Mm]y[Hh]ostname|MYHOSTNAME) |
| Info | ||
|---|---|---|
| ||
How specific your regular expression matches are will depend on your requirements.
^<[0-9]+> |
| Info | ||
|---|---|---|
| ||
Search for a 'whitespace' character, followed by the text 'myword' followed by another whitespace character, or an end-of-line marker.
|
...