Making specific rules for lms/cms

playbooks/roles/splunkforwarder/defaults/main.yml

@@ -23,6 +23,14 @@ SPLUNKFORWARDER_DEB: !!null
 SPLUNKFORWARDER_PASSWORD: !!null
 
 SPLUNKFORWARDER_LOG_ITEMS:
+  - directory: '{{ COMMON_LOG_DIR }}/lms'
+    recursive: true
+    index: '{{COMMON_ENVIRONMENT}}-{{COMMON_DEPLOYMENT}}'
+    sourcetype: 'edx'
+  - directory: '{{ COMMON_LOG_DIR }}/cms'
+    recursive: true
+    index: '{{COMMON_ENVIRONMENT}}-{{COMMON_DEPLOYMENT}}'
+    sourcetype: 'edx'    
   - directory: '{{ COMMON_LOG_DIR }}'
     recursive: true
     index: '{{COMMON_ENVIRONMENT}}-{{COMMON_DEPLOYMENT}}'