topic Re: Indexed field with spaces in the value in Getting Data In

Indexed field with spaces in the value

vbumgarn — Wed, 28 Dec 2011 18:26:35 GMT

What is the proper way to create an indexed field with spaces in it?

Given something like:

log message foo="value with spaces"

I can't seem to come up with a transform that allows me to search against that value. I have a good reason for an indexed field (capturing millions of disparate sources without exploding Sources.meta), but the filenames have spaces in them.

Here's the closet I've been able to come, but the search requires a * on the end, like orig_source="value with spaces*" to work.

[copy_source]
SOURCE_KEY=MetaData:Source
REGEX=source::(.*)
FORMAT=orig_source::"$1"
WRITE_META = true

I have also tried

FORMAT="orig_source::$1"

and:

FORMAT=orig_source::$1

to no avail.

Thoughts?

Re: Indexed field with spaces in the value

dwaddle — Wed, 28 Dec 2011 18:38:08 GMT

Have you also added the indexed field to fields.conf ? Something like:

[orig_source]
INDEXED=true

This may not help your issue, but ISTR that it is required.

Re: Indexed field with spaces in the value

vbumgarn — Wed, 28 Dec 2011 19:57:08 GMT

It doesn't seem to matter. Give it a try and see if you can come up with a working example.

Re: Indexed field with spaces in the value

vbumgarn — Wed, 28 Dec 2011 20:01:13 GMT

Actually, I may have it working...
INDEXED=true

FORMAT=newfield::"$1"

Maybe.

Re: Indexed field with spaces in the value

vbumgarn — Wed, 28 Dec 2011 20:04:42 GMT

Success. The combination of INDEXED=true in fields.conf and FORMAT=newfield::"$1" in transforms.conf seems to do the trick.