Evals are not performed in any particular order. You cannot do an eval that depends on another eval.
You will need do
EVAL-uid = substr(mid, 0, 5).
EVAL-message_id = mid by
FIELDALIAS-mid_as_message_id = mid AS message_id. Field aliasing is performed after field extraction, but before calculated fields (EVAL-* statements), so you can use the
message_id alias in your
[my_sourcetype] .... EVAL-message_id = mid EVAL-url = substr(xurl, 0, 15) EVAL-uid = substr(mid, 0, 5)
In your case it is not working because in props.conf all EVALs in a stanza execute parallel.
Hope this helps!!!