Can I configure transforms.conf to route data to different sourcetypes and indexes based on host?

[a212830]

Hi,

I have a bunch of different hosts going to a network port for syslog and need to route to different indexes/sourcetypes based upon the hostname. Can I have one transforms that does both (for each different host regex)...

[somesoni2]

You can override only one metadata at a time using the Transforms, so you you'd need two transforms for each host regex to override both sourcetype and index. It should work like this

props.conf
[yourhostspecification]
TRANSFORMS-sourcetype=overridesourcetype
TRANSFORMS-index=overrideindex

transforms.conf
[overrideindex]
SOURCE_KEY = MetaData:Host
REGEX = rexForYourHost
DEST_KEY=_MetaData:Index
FORMAT = newindexname

[overridesourcetype]
SOURCE_KEY = MetaData:Host
REGEX = rexForYourHost
DEST_KEY=MetaData:Sourcetype
FORMAT = sourcetype::newsourcetype

[shan_santosh]

What could be the value for REGEX if I want to set index for events coming from Server001?