Changing hostname from FQDN to shortname from syslog input

[MasterOogway]

I have an issue with mixed hostnames being defined as FQDN and Shortnames when indexed from syslog on port 514. I require all hostnames to be Short. I am trying to define a transforms (or another method) to take only the shortname from the HOST field but have stumbled on how this is accomplished given the hostname is defined NOT from within the event string, but from the forwarding host. So there is nothing to build a Transforms around/against.

Is there a simple method to define a shortname (and not at seach time) as the data is indexed from syslog?

[iunderwood]

I did something very similar for my Riverbed App, by using a pair of search-time transforms. The first takes the first element of the shortname ... but I also needed something to return a full IPv4 address. It does assume that hostnames do not begin with a number:

This is in props.conf:

REPORT-rbsh_hostname = rbsh_hostname
REPORT-rbsh_hostname_ip = rbsh_hostname_ip

This is in transforms.conf:

[rbsh_hostname]
SOURCE_KEY = host
REGEX = (?=[a-zA-Z])(?P<hostname>[^ ]+?)\.
FORMAT = hostname::$1

[rbsh_hostname_ip]
SOURCE_KEY = host
REGEX = (?=\d+\.\d+\.\d+\.\d+)(?P<hostname>[^$]+)
FORMAT = hostname::$1

This should be able to point you in the right direction.