We are logging one application deployed in Kubernetes and ingesting its tomcat localhost access logs in Splunk via HEC (HF).
I've pushed the props.conf and transforms.conf on HF as well as on indexers through Indexer Master but the problem is that extractions as well as transforms are not working et all.
Sample log:
10.1.0.225 - - [12/Mar/2021:13:39:51 +0000] "PUT /outlookaddin/v1/edap/sessions HTTP/1.1" 200 25
===============================
props.conf
[tomcat:localhost]
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
ANNOTATE_PUNCT = false
SHOULD_LINEMERGE = false
TIME_PREFIX=\[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
LINE_BREAKER = ([\r\n]+)\d+\.\d+.\d+\.\d+
TRUNCATE = 0
EXTRACT-access =^(?P<ip>[^\s]+)\s(?P<indent>(-|\w+))\s(?P<user>(-|\w+))\s\[(?<req_time>[^\]]+)\]\s\"(?P<method>\w+)\s(?P<request_uri>[\S]+)\s(?P<protocol>[^\"]+)\"\s(?P<status>\d{3})\s(?P<bytes_sent>(?:\d+|-))
FIELDALIAS-bytes_in = bytes_sent AS bytes_in
FIELDALIAS-http_method = method AS http_method
FIELDALIAS-uri_query = request_uri AS uri_query
FIELDALIAS-ip = ip AS src
EVAL-bytes_in = if(bytes_in=="-", 0, bytes_in)
EVAL-bytes_sent = if(bytes_sent=="-", 0, bytes_sent)
EVAL-vendor_product = "Apache Tomcat"
EVAL-product_family = "Apache Foundation Software"
EVAL-bytes = coalesce(bytes_in, 0)+coalesce(bytes_out, 0)
FIELDALIAS-response_code = status AS response_code
TRANSFORMS-anonymize=token-anonymizer
==========================================
transforms.conf
[token-anonymizer]
REGEX = (?m)^(.*accessToken\=).+(tokenType.*refreshToken=).+(expiresInSeconds.*username\=)\w+(.+ParamKey-dimensions-ParamKey\-).*(ParamKey.+)
FORMAT = $1######&$2######&$3######&$4#######$5
DEST_KEY = _raw
