topic Re: Overriding host-field in Getting Data In

Overriding host-field

dav_muel — Fri, 26 Mar 2021 19:55:53 GMT

Hi,

I have events like this:

server=serverA
field1=foo
field2=bar

And I would like to override the host-field with serverA so I configured on our indexers:

props.conf

[foo:bar]
DATETIME_CONFIG = CURRENT
LINE_BREAKER = field2=.*([\r\n]+)
SHOULD_LINEMERGE = false
TRANSFORMS-A = trans_host

transforms.conf

[trans_host]
REGEX = SERVER\=(\w+)$
FORMAT = host::$1
DEST_KEY = MetaData::host

But it's not working.. I still get the original host-value.
What am I missing here?

scelikok — Sat, 27 Mar 2021 05:24:27 GMT

Your problem maybe in REGEX, please try below.

[trans_host] REGEX = server\=(\w+) FORMAT = host::$1 DEST_KEY = MetaData::host

Funderburg78 — Tue, 30 Mar 2021 17:17:40 GMT

So what your saying is he needs to use lowercase server instead of uppercase server?.?

scelikok — Wed, 31 Mar 2021 07:54:38 GMT

Yes, because on your sample data it is uppercase. Since regex work case sensitive , it should work.