topic Re: How do I filter by three fields then do rerouting at the same time? in Getting Data In

How do I filter by three fields then do rerouting at the same time?

nethern — Tue, 23 Oct 2018 02:38:02 GMT

How do I filter by host name, source type, and message match regex, then rerouting at the same time?

I want to achieve this:

For each event, if
1) host name is one of host1, host2 and
2) sourcetype is "linux:messages" and
3) message matches "Application:\s(Error|Warning)" regex
then go to index cluster 2

How do i do that? I can see a lot of other similar questions about filtering and rerouting, but none deals with three conditions.

Re: How do I filter by three fields then do rerouting at the same time?

FrankVl — Tue, 23 Oct 2018 12:14:22 GMT

I'm not aware of any way to do this for 3 'fields'. You can do a sourcetype triggered transforms, and use the REGEX on the host field (to cover your 2nd condition) or use the REGEX on the raw message (to cover your third condition).

If the hostname is also in the raw event, of course, you could incorporate that into your regex, e.g. something like (host1|host2).*Application:\s(Error|Warning). But the more hostnames involved, the uglier (and slower) that gets of course...

Re: How do I filter by three fields then do rerouting at the same time?

nethern — Thu, 25 Oct 2018 00:51:16 GMT

The events don't contain host names there. Can't each stanza in transforms.conf apply two transforms? or grouping two into one?