I have log files in directory structure like this:
I want to dynamically set the index to the 4th element of the source path (i.e. index-a, index-b or index-c).
I have configured the following settings:
disabled = false
followTail = 0
_blacklist = .(gz|zip|bkz|arch|trc)$
TRANSFORMS-index = override-index
SOURCE_KEY = MetaData:Source
REGEX = /var/log/data/([^/]+)
FORMAT = $1
DEST_KEY = _MetaData:Index
However all log files are directed default main index.
have you tried to change the regex in the source stanza to something like this [source::.../var/log/data/...]
That seems to have resolved by issue. Thanks every much.