I have the following props.conf / transforms.conf setup. Trying to set aside PCI into it's own set of indexers. However, redirection only works with a fully qualified hostname. Wildcards don't seem to work. Is there something I am missing?
REGEX=. DEST_KEY=_TCP_ROUTING FORMAT=pci-group
I'm glad that you are figuring out the wildcards/regex for props.conf.
However, it would be easier - and more efficient - if you could do this routing at input time, instead during parsing.
You can specify the tcp routing in inputs.conf as well. It would look like this:
inputs.conf (on the hosts that you want to route in a special way)
[monitor:///therightfiles] _TCP_ROUTING = pciRoutingbeta