Overriding host-field

[dav_muel]

Hi,

I have events like this:

server=serverA
field1=foo
field2=bar

And I would like to override the host-field with serverA so I configured on our indexers:

props.conf

[foo:bar]
DATETIME_CONFIG = CURRENT
LINE_BREAKER = field2=.*([\r\n]+)
SHOULD_LINEMERGE = false
TRANSFORMS-A = trans_host

transforms.conf

[trans_host]
REGEX = SERVER\=(\w+)$
FORMAT = host::$1
DEST_KEY = MetaData::host

But it's not working.. I still get the original host-value.
What am I missing here?

[scelikok]

Yes, because on your sample data it is uppercase. Since regex work case sensitive , it should work.

[scelikok]

Hi @dav_muel,

Your problem maybe in REGEX, please try below.

[trans_host]
REGEX = server\=(\w+)
FORMAT = host::$1
DEST_KEY = MetaData::host

[Funderburg78]

So what your saying is he needs to use lowercase server instead of uppercase server?.?