I've setup HEC on a heavy forwarder to gather logs through HEC for Ansible Tower.
Logs are rolling in, but I can't seem to get props/transforms setup correctly to rename the hostname from IP to text.
[host::$ipaddress] TRANSFORMS-$hostname_rename = host_rename_$hostname
[host_rename_$hostname] REGEX = (.*) DEST_KEY = MetaData:Host FORMAT = host::$hostname
I've applied these setting to both the HF and to my Indexer cluster and neither place renames the hostname from IP address to text.
Is there something special with HEC or HF that's preventing these changes from taking place?
Which endpoint are you using to connect to your HEC? /services/collector or /services/collector/event or /services/collector/raw ?
Only data going through /services/collector/event will get affected by props / transforms.
Hope this helps...
/services/collector/event endpoint, if you want to parse data using props/transforms then you need to use
I had to update the props to use 127.0.0.1 instead of it's actual IP. I'm not sure what changed since yesterday with my testing.
I left the endpoint as
/services/collector/event and my props/transforms are working.
TRANSFORMS-$hostnamerename = hostrename_$hostname
REGEX = (.*)
DEST_KEY = MetaData:Host
FORMAT = host::$hostname