topic Re: relationship between props.conf and transforms.conf in Getting Data In

relationship between props.conf and transforms.conf

shangshin — Mon, 28 Sep 2020 11:49:20 GMT

I added a sourcetype, weblogic_access_log, with its customized field (wl_kv_and_fields
) in props.conf and transforms.conf. If I need to add another sourcetype e.g. tomcat_access_log with a different customized field e.g. tomcat_kv_and_fields. How could I define it in transforms.conf? Hope I am understood. Thanks!

in props.conf

[weblogic_access_log]

REPORT-myfields = wl_kv_and_fields

in transforms.conf

DELIMS = "\t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken

Re: relationship between props.conf and transforms.conf

MatthewTowey — Tue, 15 May 2012 13:16:44 GMT

Hi shangshin

In your props.conf file you have "REPORT-myfields = wl_ kv_ and_ fields" so the stanza been referenced in transforms.conf has to be called "wl _kv _and _fields". For example

[wl_ kv_ and_fields]

DELIMS = "t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken

You can reference this stanza for any amount of sources/sourcetypes provided you use the line "REPORT-myfields = wl_ kv_ and_fields"

Re: relationship between props.conf and transforms.conf

shangshin — Tue, 15 May 2012 15:09:56 GMT

good answer. Thanks!