I have a feed where the fields are separated by brackets (<>). I have a transforms.conf that extracts the fields automatically:
REGEX = <([^\/][^>]+)>(.*?)<\/[^>]+> FORMAT = $1::$2 MV_ADD = true
Unfortunately, the fields are all uppercase. I don't see any way to make the fields lowercase, so I've started creating aliases, using FIELD_ALIAS. We need to do this so that they are caught by our ES rules. I also need to do a transforms to map the values appropriately.
Here is a sample field: "Allow
I want to create an alias with the field name to be "action" and a transform that makes the value "allowed". I get the new field, but the transform is not working. Here's what I have configured:
FIELDALIAS-action = ACTION as action
[forcepoint_xml] REGEX = <([^\/][^>]+)>(.*?)<\/[^>]+> FORMAT = $1::$2 MV_ADD = true [ACTION] REGEX = (Allow|Permit) FORMAT = ACTION::allowed
Couldn't this all be done with one SED command (building on @maciep's suggestion)? I haven't tested but I imagine something with capture groups and forcing lowercase. This essentially combines what everyone else has said.
SED-yaay = s/>(allow|permit)</\L\1/i
The syntax is prob all wrong but the point is that instead of capturing anything you're capturing the specific terms you wanted, using the
/i at the end to do case irrelevant. Using the
\L that @woodcock introduced to force case on output.
Not entirely sure why your current transforms is not working (except that you are not showing the respective props.conf line) but this is typically resolved with calculated fields or lookups, rather than transforms.
For example, in props.conf (this also gets rid of the need for a FIELDALIAS):
EVAL-action = case(ACTION="Allow","allowed",ACTION="Permit","allowed")
When the number of options grows, a lookup might be a more suitable approach.
PS: any specific reason you're using a custom regex, rather than setting
KV_MODE = xml in props.conf?
you might be able to just use eval instead of a field alias. Maybe like this...obviously you can additional allowed/blocked logic:
EVAL-action = if(match(ACTION,"(?i)allow|permit"),"allowed","blocked")
You could also create an automatic lookup to lookup ACTION and spit out the various actions as well - maybe not needed here, but that approach can come in handy in general when mapping data to the CIM.