Custom Log ingestion

[Shal]

Hi Team,

I need to add below custom log path for log monitoring where file name will be in the yyyy-mm-dd.log format and we need only log levels Error from the log.

Path Location	File Name	Error Code, String, pattern match
D:\logs\xxx.yyy	YYYY-MM-DD.log	ERROR

As per documentation, added the log in custom log path  as d:\Logs\xxx.yy\*.logs under host>logmonitoring .

How can we ensure it is picking the exact file?

Where can I add the filter condition?

Can someone give the right steps on how to add the custom logs with filter conditions?

Thanks

[AntonPineiro]

Hi,

When you add a custom path, if should appears when you are creating log ingestion rule.

Best regards

[Mizső · Accepted solution]

Hi @Shal 

You can easily ingest custom logs.

Option 1.

Option 2.

As @AntonPineiro  mentioned, you can ingest the custom log source and then filter it.

You can check the results in the Logs at managed and saas also.

I hope it helps.

Best regards,

János

[Shal]

Thankyou @Mizső .The detailed explanation is very helpful.

1)I can see option 1 is already enabled in my environment .So Can I also have both Option 1 and  Option 2?

2)I have  added ingestion rule as Log source - is any of custom log and

                                                                               log level is any of ERROR.

But it was showing for WARN log levels also.

Then I tried adding processing rule to filterout WARN, and it was showing only for ERROR log levels. But this rule will apply to all logs irrespective of host.

Also when am giving path as D:\logs\xxx\Errors\#.log  I can see the filename is showing as today's date like 2025-04-16. However it is not showing the older files (like yesterday's or other dates even when we take custom date picker).

Any recommendations do you have?

Thanks!

[Mizső · Accepted solution]

Hi @Shal,

I prefer the option 2. 

Could you please share your option 2 settings. Only ERROR level logs should be ingested.

Regarding date issue, only the new log lines will be ingested after the settings. Some days later you should see the logs in the same source D:\logs\xxx\Errors\#.log

Best regards,

János

[Shal]

Thanks Janos.

I disabled default option -( option 1 )and enabled option 2 . I removed processing rule as well.

option 2- create rule for each log source and add condition in that rule.

It is working with that setting.

Thanks for your guidance.