Hi, I need to set at the same time in transforms.conf a new index and set a new metadata based on the host name.
New index=switchoob New metadata=tecnologia
Like this:
[force_IndexVMW]
SOURCE_KEY = MetaData:Host
REGEX = ^ob\w+
DEST_KEY = _MetaData:Index
FORMAT = switchoob
[force_tecnologiaVMW]
SOURCE_KEY = MetaData:Host
REGEX = ^ob\w+
DEST_KEY = _meta
FORMAT = NFV_SITE::DC02_MIBER tecnologia::vmw
I have tried to find "More than one DEST_KEY" article but the link is wrong.
Thank You
@FrankFZ - Please confirm the following things on your environment.
You also need to add fields.conf on Search Head:
[tecnologia]
INDEXED=true
[NFV_SITE]
INDEXED=true
transforms.conf
[force_IndexVMW]
SOURCE_KEY = MetaData:Host
REGEX = ^ob\w+
DEST_KEY = _MetaData:Index
FORMAT = switchoob
[force_tecnologiaVMW]
SOURCE_KEY = MetaData:Host
REGEX = ^ob\w+
WRITE_META = true
FORMAT = NFV_SITE::DC02_MIBER tecnologia::vmw
I hope this helps!!! Upvote/Karma would be appreciated!!!
Thanks very much for your suggestions. Do you confirm that the configuration of the transforms.conf file allows me to perform 2 redirections? One for the index and one for the meta field for the same hosts? Thank You!
Yes, that shouldn't be a problem.