topic Why do some logs come into indexer with empty host field? in Getting Data In

Why do some logs come into indexer with empty host field?

Adpafer — Tue, 30 May 2023 04:03:33 GMT

Hi,

There are some logs that come to Indexer with empty host field (host= ). These logs come to main index and I would like them to come to another index. I have source and sourcetype. I try to override index and route the logs to another index but it does not work. Here is my config. I would appreciate any help. Thx.

props:

[host:: ]
TRANSFORMS-myindex=override-index

transforms:

[override-index]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = myindex

Re: empty host field

isoutamo — Mon, 29 May 2023 18:18:35 GMT

Hi
Any idea from where those are coming and why they didn't contain host value? Usually that should be there!
I try to figure out and fix this instead of trying send those to specific index with props and transforms.conf.
r. Ismo

Re: Why do some logs come into indexer with empty host field?

gcusello — Tue, 30 May 2023 06:41:34 GMT

Hi @Adpafer ,

probably the issue is that in the regex of the override-index standa you have to put a regex that reads the value to assign to the host field, using "REGEX = ." you use a string not acceptable for the host index.

Probably in the first part of your logs, there's the hostname definition, you have to use that regex to assign a correct value to the host, e.g. having an event like the following

2023-05-29 11:22:54 my_hostname 12345 ...

you have to use a regex like the following:

REGEX = ^\d\d\d\-\d\d-\d\d\s\d\d:\d\d:\d\d\s($1) DEST_KEY = MetaData:Host FORMAT = host::$1

you can use the "REGEX = ." expression only if you want to assign a fixed value to the host field.

Ciao.

Giuseppe