Mask data at indexserver for only some of the indexes

[jnhth]

I want to mask only data in my test indexes (I have both prod and test indexes on 1 indexer server)

Can I do so? As I can see the masking is applied to all my indexes with data from a specified spurcetype.

Ex:
props.conf:
[source::...\access.log*]
sourcetype = access_common

transform.conf:
[access_common]
SE-msi1 = q/(\/eb\/res\/rec\/Number\/\d{2})\d{4}/\1xxxx/

[woodcock · Accepted solution]

Given your clarification:

Some host are test and some are prod - the filename is the same but the paths are different

Then you can do this:

props.conf:

[source::.../UniqueSegmentOfTestPath/...]
sourcetype = access_common_filter_first

[source::.../UniqueSegmentOfProductionPath/...]
sourcetype = access_common

transform.conf:

[access_common_filter_first]
SE-msi1 = q/(/eb/res/rec/Number/d{2})d{4}/1xxxx/
rename = access_common

[woodcock]

What discriminates test vs. prod? Is there a difference in the path/file? Are some hosts prod and some test?

[jnhth]

Some host are test and some are prod - the filename is the same but the paths are different

[somesoni2]

Since both prod and test are on same server and surely, they will have same sourcetype and can have same source, try to setup the masking based on host (in props.conf).