This target writes data to files. These can then be collected by Logstash or a Splunk Forwarder.
Files will be “rolled” – renamed and additional information added to their names - to maintain a number of versions of them, as defined in the these parameters.
If the ConnectorType is set to File, these fields are required - all have a Parent Field of FileConfiguration:
Field |
Description |
Valid Values |
Default Value |
Path |
The path to the directory where the file will be written.
On Windows, backslashes will need to be escaped by duplicating the backslash. For example:
"Path": "C:\\log" ,Escaping the backslash is not required on Linux systems. For example:
"Path":"/home/destination" |
Valid file system path |
None, mandatory |
FileNamePrefix |
The start of the file name. |
|
None, mandatory |
FileNameSuffix |
The end of the file name. This can be used to specify a file extension. |
|
None, mandatory |
RollWhenTooBig |
If set to true, then the file will be rolled once it exceeds the value of RollSizeMB. |
true, false |
true |
RollSizeMB |
Once the file has reached this size it will be rolled, and a new file will be createdfor all new records.
|
Positive integer |
30 |
RollWhenTooOld |
If set to true, then the file will be rolled according to the value of RollHour. |
true, false |
true |
RollHour |
If the file was created yesterday and the current hour is greater than RollHour then the file will be rolled. |
Integer from 0 - 23 |
0 |
HousekeepUsingQuantity |
Whether to housekeep files based on number of files. |
true, false |
true |
MaxBackupIndex |
Once the number of rolled files exceeds this number then the oldest rolled files, based on the datetime stamp in the file name, will be deleted until only this number of rolled files remain. |
Integer from 0-999 |
1 |
HousekeepUsingAge |
Whether to housekeep files based on the age of the file, as determined by the datetime stamp in the file name. |
true, false |
false |
MaxBackupDays |
Once the difference between ‘now’ and the datetime stamp in the rolled file’s name exceeds this number of days then housekeeping will delete this file. |
Integer from 0-999 |
None |
|
The creation date and time of the file will be written between the file prefix and suffix; that is, the filename will be in this form:
<Sourcename><FileNamePrefix><DateTimeOfCreation><FileNameSuffix>
If the Source has been configured to obtain the host name, then this will be written as a part of the filename. The filename will then be in this form:
<HostName>-<FileNamePrefix><DateTimeOfCreation><FileNameSuffix>