All,
I have the following props.conf / transforms.conf setup. Trying to set aside PCI into it's own set of indexers. However, redirection only works with a fully qualified hostname. Wildcards don't seem to work. Is there something I am missing?
transforms.conf
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=pci-group
props.conf
doesn't work
[host::myvery.*]
TRANSFORMS-routing=pciRoutingbeta
doesn't work
[(?::){0}myvery*]
TRANSFORMS-routing=pciRoutingbeta
doesn't work
[(?::){0}myvery.*]
TRANSFORMS-routing=pciRoutingbeta
does work!
[host::myverylongservername]
TRANSFORMS-routing=pciRoutingbeta
I'm glad that you are figuring out the wildcards/regex for props.conf.
However, it would be easier - and more efficient - if you could do this routing at input time, instead during parsing.
You can specify the tcp routing in inputs.conf as well. It would look like this:
inputs.conf (on the hosts that you want to route in a special way)
[monitor:///therightfiles]
_TCP_ROUTING = pciRoutingbeta
did you try host::myvery*?
try sk314´s way. this is explained in props.conf documentation.