topic Re: Multiple Transforms Stanzas Inside One Props Stanza - Limit? in Getting Data In

Multiple Transforms Stanzas Inside One Props Stanza - Limit?

aferone — Tue, 26 Nov 2013 22:40:48 GMT

Here is my current props.conf stanza for UDP:514 syslog traffic. I am sending this traffic to multple indexes using transforms.conf

props.conf:

[syslog]
TRANSFORMS-index = Stan1, Stan2, Stan3

transforms.conf

[Stan1]
SOURCE_KEY = MetaData:Host
REGEX = (host1|host2|host3)\.domain\.here\.com
DEST_KEY = _MetaData:Index
FORMAT = index1

[Stan2]
SOURCE_KEY = MetaData:Host
REGEX = (host4|host5|host6)\.domain\.here\.com
DEST_KEY = _MetaData:Index
FORMAT = index2

[Stan3]
SOURCE_KEY = MetaData:Host
REGEX = (host7|host8|host9)\.domain\.here\.com
DEST_KEY = _MetaData:Index
FORMAT = index3

This seems to work just fine. However, I am now trying to add a 4th reference to a stanza in props.conf under syslog. When I do this, and add the appropriate stanza in transforms.conf, all of the syslog ends up in one index, and it doesn't seem to be consistent when I restart the Heavy Forwarder.

Is there a limit to how many stanzas I can reference in transforms.conf from one stanza in props.conf [syslog]?

Thanks!

Re: Multiple Transforms Stanzas Inside One Props Stanza - Limit?

_d_ — Wed, 27 Nov 2013 00:09:50 GMT

No, there is no limit. Well, I suppose there is a limit for everything, but in this case it's certainly not 4.

Re: Multiple Transforms Stanzas Inside One Props Stanza - Limit?

lukejadamec — Wed, 27 Nov 2013 00:50:17 GMT

What is the fourth stanza? It must be grabbing them all some how.

Re: Multiple Transforms Stanzas Inside One Props Stanza - Limit?

aferone — Mon, 28 Sep 2020 15:22:35 GMT

The 4th one is just basically a continuation:

[Stan4]
SOURCE_KEY = MetaData:Host
REGEX = (host10|host11|host12).domain.here.com
DEST_KEY = _MetaData:Index
FORMAT = index4

Re: Multiple Transforms Stanzas Inside One Props Stanza - Limit?

aferone — Wed, 27 Nov 2013 13:58:49 GMT

Is the way I'm trying to do it a common approach?

Re: Multiple Transforms Stanzas Inside One Props Stanza - Limit?

arunsunny — Tue, 29 Sep 2020 15:49:25 GMT

Hi All,

Facing few challlenges, mine is playing around with the same transforms.

I'm trying to achieve the same source data to forward to two different logical indexes and two different indexes groups.

Below is my senrio.

In props.conf used

[source::Dual_Data_Testing]
TRANSFORMS-source = Stan1, Stan2

In transforms.conf

[Stan1]
SOURCE_KEY = MetaData:Source
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = Index1
DEST_KEY = _TCP_ROUTING
FORMAT = IndexerGroup1

[Stan2]
SOURCE_KEY = MetaData:Source
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = Index2
DEST_KEY = _TCP_ROUTING
FORMAT = IndexerGroup2

Currently the above conf is not working.

Please any suggestion can we workaround for this ?

Thanks,
Arun Sunny