Created 07-28-2017 11:44 AM
In our case we have 5 different TailFile processors as inputs and we use 5 UpdateAttribute processors to tag the flowfile comming off the TailFile processors. But this results in a crazy looking data flow with an UpdateAttribute processor for each TailFile processor.
So my idea was, to link each TailFile processors to one and the same UpdateAttribute processor, with each a different relationship name. Within the UpdateAttribute I wanted to grep the relationship name and put this as an attrbute on the flow file.
But the question is, how to get the relationship name? If this is not possible is there a more simple and manageble way to tag flow files based on the input processor (TailFile)?
Thank you.
Created 07-31-2017 05:14 PM
The TailFile processor adds the following attribute to each flow file it creates, tailfile.original.path = Path of the original file the flow file comes from. You could use the value of this attribute to add any additional attributes or for routing.
Created 07-31-2017 05:14 PM
The TailFile processor adds the following attribute to each flow file it creates, tailfile.original.path = Path of the original file the flow file comes from. You could use the value of this attribute to add any additional attributes or for routing.
Created 08-01-2017 12:00 PM
This will work, thank you! I've linked all TailFile inputs to a single UpdateAttribute. Using the Advanced option I've created per TailFile a rule.
For TailFileSuricata:
Conditions
${tailfile.original.path:find('/var/log/suricata/.*')}
Action