When using Ironstream for IBM Z as a Source, the agent should be configured with the parameter "TARGET":"GENERIC" because JSON records will be delimited with “\n” and metadata such as might be included for Splunk is not present. This means the format is compatible with Hub.
Example Ironstream core configuration file:
[KEYS]
"KEY_WARN_DAYS":"090"
"KEY":"xxxxxx"
[SYSTEM]
"NAME":"IHS4"
[DESTINATION]
"TARGET":"GENERIC"
"IPADDRESS":"10.16.0.112"
"PORT":"4236"
"SSL":"NO"
[SOURCE]
"DATATYPE":"SYSLOG"
"FILTER":"SSDFFLOG"
The important items are that TARGET should be set to GENERIC, the IPADRESS should point to the Hub system, and the PORT value should match the port set for an IBM Z source.
Note: All Hub delimiter properties, including TcpIpServerConfiguration:Delimiter, should be set to “\n”.