Indexed field with spaces in the value

[vbumgarn]

What is the proper way to create an indexed field with spaces in it?

Given something like:

log message foo="value with spaces"

I can't seem to come up with a transform that allows me to search against that value. I have a good reason for an indexed field (capturing millions of disparate sources without exploding Sources.meta), but the filenames have spaces in them.

Here's the closet I've been able to come, but the search requires a * on the end, like orig_source="value with spaces*" to work.

[copy_source]
SOURCE_KEY=MetaData:Source
REGEX=source::(.*)
FORMAT=orig_source::"$1"
WRITE_META = true

I have also tried

FORMAT="orig_source::$1"

and:

FORMAT=orig_source::$1

to no avail.

Thoughts?

[dwaddle · Accepted solution]

Have you also added the indexed field to fields.conf ? Something like:

[orig_source]
INDEXED=true

This may not help your issue, but ISTR that it is required.

[vbumgarn]

Success. The combination of INDEXED=true in fields.conf and FORMAT=newfield::"$1" in transforms.conf seems to do the trick.

[vbumgarn]

Actually, I may have it working...
INDEXED=true

FORMAT=newfield::"$1"

Maybe.

[vbumgarn]

It doesn't seem to matter. Give it a try and see if you can come up with a working example.