Is it possible for a field alias for all sourcetypes to exclude a specific one?

[aasabatini]

Hi folks,

I have a field alias for my all sourcetypes 

[default]
FIELDALIAS-cliente = index AS client

but I want to exclude some sourcetypes for example I dont' want this field alias for stash or internal log.

is it possible?

[gcusello]

Hi @aasabatini ,

Ciao Ale,

Could you better describe you requirement?

anyway, I think that you could try with a calculated field (in which you can insert a condition) instead a field alias.

Ciao.

Giuseppe

[aasabatini]

Hi @gcusello 

I hope you are well.

I need  the field client based on the  index field value  for all my data except for stash sourcetype, currently the field alias works fine with the global configuration but I didn't find to exclude the souretype stash.

[gcusello]

Ciao Ale,

did you tried with a calculated field?

Ciao.

Giuseppe

[aasabatini]

Hi @gcusello 

calculated or field-alias is the same under default stanza on props, I need a strategy to exclude the stash sourcetype.

Regards

Ale

[gcusello]

Ciao Ale,

using a calculated field, you can insert a condition like the ones you described, that you cannot insert in an alias.

Ciao.

Giuseppe

[aasabatini]

Hi @gcusello 

unfortunately doesn't works, for example if I created a condition to exclude the sourcetype stash like this:

[default]
EVAL-cliente = if(sourcetype="stash","",index)

when you call for example the index with stash sourcetype, you will have the cliente field empty, but I need no field for that sourcetype.

I suppose the best strategy is define  any field -alias for all sourcetypes and don't set any rule for stash

[gcusello]

Ciao Ale

only you can define if this workaround can be a solution for yoit requirement, but I think that could have sense.

Ciao.

Giuseppe

[glc_slash_it]

Hey!
The props.conf documentation says the following for default:

# Use the [default] stanza to define any global settings.
#   * You can also define global settings outside of any stanza, at the top
#     of the file.
#   * Each conf file should have at most one default stanza. If there are
#     multiple default stanzas, settings are combined. In the case of
#     multiple definitions of the same setting, the last definition in the
#     file wins.
#   * If a setting is defined at both the global level and in a specific
#     stanza, the value in the specific stanza takes precedence.

I would try out the following

Keep your config for default stanza

[default]
FIELDALIAS-cliente = index AS client

Define the fieldalias as null/none, for all other sourcetypes you want to exclude

[_internal]
FIELDALIAS-cliente = 

[other_sourcetype]
FIELDALIAS-cliente = 

------------
If this was helpful, some karma would be appreciated.

[aasabatini]

Hi @glc_slash_it 

unfortunately this solution doesn't works.

need to find another solution