topic Transform for sourcetype not working in Getting Data In

Transform for sourcetype not working

NeilGingell — Mon, 28 Sep 2020 10:19:17 GMT

I have setup a transform to ideally set the hostname and sourcetype for syslog traffic, however I'm encountering problems.

I have the following in the transforms.conf:

[firepass_sourcetyper] REGEX =
(?:192.168.249.106) DEST_KEY =
MetaData:sourcetype FORMAT =
sourcetype::firepass_log

[firepass_hostnamer] REGEX =
(?:192.168.249.106) DEST_KEY =
MetaData:host FORMAT =
host::rm.markerstudy.com

And I have the following in my props.conf file:

[source::udp:514]

TRANSFORMS-firepasssoucetype = firepass_sourcetyper
TRANSFORMS-firepasshostname = firepass_hostnamer

I'm not sure if it's possible to do multiple transforms for a single source as I am trying, however for the purpose of testing this I have commented out the second transforms statement.

Can anybody help as to why this isn't working?

Thanks,
Neil

Re: Transform for sourcetype not working

hedgehog — Mon, 28 Sep 2020 10:19:20 GMT

Hi, I think you problem is that the MetaData variables are case sensative.

Try:

In props.conf

[source::udp:514] TRANSFORMS-firepasssoucetype = firepass_sourcetyper TRANSFORMS-firepasshostname = firepass_hostnamer

In transforms.conf
[firepass_sourcetyper] REGEX = (?:192.168.249.106) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::firepass_log

[firepass_hostnamer]
REGEX = (?:192.168.249.106)
DEST_KEY = MetaData:Host
FORMAT = host::rm.markerstudy.com

Re: Transform for sourcetype not working

Lamar — Tue, 17 Jan 2012 15:11:38 GMT

Neil,

You should be able to put all of your transforms on one line...ie.

[source::udp::514]
TRANSFORMS-firepass_stuff = firepass_sourcetyper,firepass_hostnamer

Also keep in mind that the DEST_KEY(s) are case sensitive, so you would need:

[firepass_sourcetyper] 
REGEX = (?:192.168.249.106) 
DEST_KEY = MetaData:Sourcetype 
FORMAT = sourcetype::firepass_log

[firepass_hostnamer] 
REGEX = (?:192.168.249.106) 
DEST_KEY = MetaData:Host 
FORMAT = host::rm.markerstudy.com

Hope that helps.

Re: Transform for sourcetype not working

NeilGingell — Tue, 17 Jan 2012 15:25:26 GMT

Both answers were spot on.

Thanks,

Re: Transform for sourcetype not working

vistasyslog — Mon, 28 Sep 2020 13:04:59 GMT

I have a similar problem. I am trying get the three IP addresses to use a new sourcetye when they send in data.

Props.conf reads :

[source::udp:514]
TRANSFORMS-riverbed_src = riverbed_steelhead
TRANSFORMS-changesourcetype = sourcetype_cisco_asa

transforms.conf reads :

[riverbed_steelhead]
REGEX = (10.12.0.20:10.0.0.33:10.10.20.185)
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::riverbed_steelhead

[sourcetype_cisco_asa]
REGEX = (10.12.254.1:10.10.20.254:10.1.250.254)
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::cisco_asa

I get the Error :

Possible typo in stanza [riverbed_steelhead] in transforms.conf. Line 4
Possible typo in stanza [sourcetype_cisco_asa] in transforms.conf. Line 10

Can someone help me find my problem please.

FYI : I also tried the format :

REGEX = (10.\12.0.20|10.0.0.33|10.10.20.185)