How to direct incoming data on universal forwarder to desired index ?

[ronak]

My Setup

I've an index by the name mobile_client1_venue1 that gets data from mobile client application that sends events to a Universal Forwarder's (say UF1) TCP port. The event contains two default attributes in addition to many other. These attributes are client_id, venue_id (for example 1,1 ; 2,103; 2,104 ; 3,109 etc)

When I've a new client say client_2_venueX; the mobile app used there will send data to the same UF1 and same TCP port, BUT the event will have client_id, venue_id combination of 2,103

I also have another index mobile_client2_venue1

Need

What can I do so that events appearing on the same UF can be directed to index mobile_client1_venue1 where (client_id, venue_id) combination is 1,1 ; and to index mobile_client2_venue1 where (client_id, venue_id) combination is 2,103

Thus I want to send the incoming events to different index based on the content of the event ...logically speaking,

if incoming event has client_id , venue_id combination = 1,1 then
send event to index = mobile_client1_venue1
if incoming event has client_id , venue_id combination = 2,103 then
send event to index = mobile_client2_venue1
else
send even to index=mobile_genetic_fetch_all
end if;

Any pointers would be greatly appreciated

[jayannah · Accepted solution]

Hope the below configuration should give u some pointer (Not tested)

props.conf
[ < source-type OR source OR host > ]
TRANSFORMS-multiroute=default_index, c1_venue1, c2_venue2

transforms.conf
[default_index]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = mobile_genetic_fetch_all

[c1_venue1]
REGEX = < rex >
DEST_KEY = _MetaData:Index
FORMAT = mobile_client1_venue1

[c2_venue1]
REGEX = < rex >
DEST_KEY = _MetaData:Index
FORMAT = mobile_client2_venue1

[jayannah]

Is this worked or still facing issue?