Renaming Host Dynamically

[peter_gianusso]

Trying to assign the "esxi_hosts" sourcetype to any event that has a value of "vm[0-9][0-9]" for the host field:

inputs.conf

[monitor://\\njros1bva0597\d$\LogFiles\W3SVC1\]
disabled = 0
host = VM99
index=imaging
whitelist = \.log$

props.conf

[source::...\\ex*.log] 
sourcetype = VM88

[source::...\\CAPPM*.log] 
sourcetype = VM11

[VM88]

TRANSFORMS-hostname = rewrite_sourcetype_from_host

transforms.conf

[rewrite_sourcetype_from_host]
SOURCE_KEY = MetaData:Host
REGEX = vm\d\d
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::esxi_hosts

[peter_gianusso · Accepted solution]

a fix to the regex of
vm\d\d
to
VM\d\d

fixed the issue

[peter_gianusso]

no that won't fix the issue given the scenario...the source type is dynamically assigned in the props.conf

[piebob]

let us know if this fixes the issue, and i will convert Kristian's comment to an answer 🙂

[peter_gianusso]

there are multiple log files in the directory and they are being assigned a sourcetype in the props.conf dynamically...I tried to simplify the information because I didn't think it was relevant...I will add the stanza

[kristian_kolb]

maybe I'm missing something... can't you just set the sourcetype in the monitor stanza in inputs.conf

[monitor]
sourcetype=esxi_hosts
blah blah
blah
etc.
etc.


[peter_gianusso]

source type always ends up as VM88