Field alias for all indexed data

[christopherutz]

I am creating some field aliases that I want to apply to multiple sourcetypes. I was hoping to do something like this in props.conf

[mysourcetype_*]
FIELDALIAS-class = fieldname as alias

My thought was this would hopefully apply the alias to the sourcetypes that match that pattern. This didn't appear to work so I resorted to something like this

[source::...*...]
FIELDALIAS-class = fieldname as alias

While this works I have two questions.

Is there a way to specify a pattern for the sourcetype like I was trying to do in the first example?

What are the performance implications, if any, of the second example, which applies the field alias to all sources?

Thanks

[benoitleroux]

Where is that documented? I have many sourcetypes starting with a pattern sm_* could I set
[(^:::){0}sm_*]
fieldalias-myfirst = myFirst AS myLast
...

To apply the fieldalias to all the sourcetypes starting with sm_ ?

[gkanapathy · Accepted solution]

There is. You can use:

[(?:::){0}mysourcetype_*]

as the sourcetype stanza header.

Your pattern to match all data could be simpler with any of:

[host::...]

[source::...]

But you can also use:

[(?:::){0}...]

Performance implications are pretty minimal for this.