I've updated the props in on a 6.1 server. Checked with
btool which claims my configs are acceptable.
I've also checked
btool props and see the updated
REPORT-access as well as
I tried loading
/debug/refresh which does show
Refreshing admin/transforms-extract OK
But when loading a few lines from the logs, I don't see any fields which I added. Neither the ones from a new
REPORT, nor the one from
EVAL. Everything looks just like it did before.
What else am I missing? Is there something else I can try to debug?
Are you certain that the data has the same sourcetype as you specified in props.conf and transforms.conf? Might you have a typo in one or more of these files? btool is great, but it only checks syntax. btool can't test the actual formatting or regular expressions since it only looks at the configuration files, not the data.
If these hints don't help, please post the relevant stanzas from props.conf and transforms.conf. A little sample data (properly anonymized of course) would also be useful to help the community answer your question.
I've got a host which adds the processing time to the end of nginx log line. This looks like the following:
client_ip - - [03/Mar/2017:09:54:56 +1100] "GET /some/path HTTP/1.1" 200 233474 "https://some/referer" "useragent" "cookies" "0.662"
This normally gets parsed by
access_combined_wcookie, but sticks "0.662" into "other" field. I want to create a
req_duration, so I added
[access_combined_wcookie] [source::/var/log/marketplace/nginx-access.log] REPORT-access = access-extractions-marketplace
[access-extractions-marketplace] # based on system access-extractions, but with extra req_duration at the end REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[access-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?<referer>[[bc_domain:referer_]]?+[^"]*+)"(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?\s++"[[float:req_duration]]"[[all:other]]
The search results are not changed however. All looks the same after reloads.