Need help extracting a hostname from a source path

[balbano]

Hey guys,

I'm a noob at props and transforms.

Trying to basically extract a hostname from a sourcepath.

Example:

/var/log/fms/host/blah/

I would like to extract "host" and use that as the hostname for the source log.

Here is how I am doing it so far:

[host-extract]
SOURCE_KEY = MetaData:Source
REGEX = (\/var\/log\/fms\/)([0-9a-zA-Z\.\-_/]+)?\/
DEST_KEY = MetaData:Host
FORMAT = $2

I also setup the following in props for this transform:

[FMS_LF]
TRANSFORMS-host = host-extract

However seems like its not working...

Any thoughts? Is my regex not right?

Any help you can provide would be great.

Thanks.

Brian

[dwaddle]

An even easier approach might be host_segment in inputs.conf. Using your example,

[monitor:///var/log/fms]
host_segment=4
sourcetype=fms_source_type