I have 3 Window servers that has an application that writes logs to a local flat file. The application also supports send the data via syslog. My question is, what is the best way to ingest the telemetry and write a few rules on it? Is it going to be sysloging it or is there a way for me to use an artifact rule to pickup and parse the files?
Hello, the easiest way is likely to use a Syslog Adapter: Syslog - LimaCharlie Documentation
This will bring in the contents in real-time in a dedicated Sensor in LimaCharlie where you can make D&R rules specifically for them.