I'm not sure I'm phrasing my question correctly, but the idea of what I'm trying to achieve is this:
<filter systemd.**>
@type record_modifier
<record>
service $NameOfASystemdServiceFromTheEntry
</record>
</filter>
so service key would docker.service or ntp.service or whatever service actually produced the log entry. Is this possible?
I'm not sure I'm phrasing my question correctly, but the idea of what I'm trying to achieve is this:
so
servicekey woulddocker.serviceorntp.serviceor whatever service actually produced the log entry. Is this possible?