Getting Data In

Why is the overriding of sourcetype and index not working?

jamesvz84
Communicator

I am trying to take a TCP feed that is setting sourcetype=sources, and want to split the events into separate indexes and sourcetypes based on their content. However, this is not working for me.

Configs are below, and are located on the heavy forwarder. Any ideas?

props.conf

[sources]
TRANSFORMS-reassign = fireeye_index,fireeye_sourcetype,fortigate_index,fortigate_sourcetype

transforms.conf

[fireeye_index]
DEST_KEY =_MetaData:Index
REGEX = |FireEye|
FORMAT = fireeye

[fireeye_sourcetype]
REGEX = |FireEye|
FORMAT = sourcetype::fireeye
DEST_KEY = MetaData:Sourcetype

[fortigate_index]
DEST_KEY =_MetaData:Index
REGEX = devname=.+fw.+device_id=
DEST_KEY = fortigate

[fortigate_sourcetype]
REGEX = devname=.+fw.+device_id=
FORMAT = sourcetype::fortigate
DEST_KEY = MetaData:Sourcetype
0 Karma

masonmorales
Influencer

In each of your transforms stanzas, you should also have:

SOURCE_KEY = MetaData:Sourcetype

masonmorales
Influencer

Also, what are you trying to match with REGEX = |FireEye|? The pipe in REX acts as an OR operator, so if you have literal pipes, then you need to escape them with a backslash. If you don't have pipes, remove them as that may be part of the problem.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!