Return
-
Title
Filtering by Host Matches Multiple Hosts -
Description
Multiple hosts logs are being dropped when filtering by host. -
Cause
The filter statement is not set correctly and is matching multiple hosts when multiple hosts share likeness in the hostname. -
Resolution
When filtering for a single host, if multiple hosts share a part of the name the filter needs to be set with a $ at the end.:
i.e.:
Host 1 = jvldcoss
Host 2 = jvldcoss2
Examples:
to filter the host "jvldcoss", if the filter statement has the following:
host("jvldcoss")
both hosts above will match the filter as they all begin with jvldcoss.
To filter only jvldcoss the filter statement would need to be the following:
host("jvldcoss$")
Using the statement directly above, only jvldcoss, the first host listed, will match the filter, allowing the second host to bypass the filter.