How to monitor same log file into different sourcetypes by ip ?

[hketer]

Hello,

I have logs from syslog server, my goal is to have events from the same log but these events will indexed with different sourcetype according to the IP in the log.
lets say I have a row in the log with IP X his sourcetype will be ST1
for IP Y the sourcetype will be ST2 and so on.

Here are my configurations

inputs.conf
[monitor://D:\Kiwi_DB]
disabled = false
index = db_it_syslog
sourcetype = transformsourcetype

props.conf
[transformsourcetype]
TRANSFORMS-transformsourcetype = change_st_by_IP1,change_st_by_IP2

transforms.conf
[change_st_by_IP1]
REGEX = "0.0.0.0"

FORMAT = sourcetype::cyberark:epv:cef
DEST_KEY = MetaData::Sourcetype

Thanks!
Hen