topic Re: Field alias for all indexed data in Getting Data In

Field alias for all indexed data

christopherutz — Sat, 20 Nov 2010 06:04:27 GMT

I am creating some field aliases that I want to apply to multiple sourcetypes. I was hoping to do something like this in props.conf

[mysourcetype_*]
FIELDALIAS-class = fieldname as alias

My thought was this would hopefully apply the alias to the sourcetypes that match that pattern. This didn't appear to work so I resorted to something like this

[source::...*...]
FIELDALIAS-class = fieldname as alias

While this works I have two questions.

Is there a way to specify a pattern for the sourcetype like I was trying to do in the first example?

What are the performance implications, if any, of the second example, which applies the field alias to all sources?

Thanks

Re: Field alias for all indexed data

gkanapathy — Sat, 20 Nov 2010 13:45:48 GMT

There is. You can use:

[(?:::){0}mysourcetype_*]

as the sourcetype stanza header.

Your pattern to match all data could be simpler with any of:

[host::...]

[source::...]

But you can also use:

[(?:::){0}...]

Performance implications are pretty minimal for this.

Re: Field alias for all indexed data

benoitleroux — Tue, 29 Sep 2020 08:04:49 GMT

Where is that documented? I have many sourcetypes starting with a pattern sm_* could I set
[(^:::){0}sm_*]
fieldalias-myfirst = myFirst AS myLast
...

To apply the fieldalias to all the sourcetypes starting with sm_ ?