Why is the overriding of sourcetype and index not working?

[jamesvz84]

I am trying to take a TCP feed that is setting sourcetype=sources, and want to split the events into separate indexes and sourcetypes based on their content. However, this is not working for me.

Configs are below, and are located on the heavy forwarder. Any ideas?

props.conf

[sources]
TRANSFORMS-reassign = fireeye_index,fireeye_sourcetype,fortigate_index,fortigate_sourcetype

transforms.conf

[fireeye_index]
DEST_KEY =_MetaData:Index
REGEX = |FireEye|
FORMAT = fireeye

[fireeye_sourcetype]
REGEX = |FireEye|
FORMAT = sourcetype::fireeye
DEST_KEY = MetaData:Sourcetype

[fortigate_index]
DEST_KEY =_MetaData:Index
REGEX = devname=.+fw.+device_id=
DEST_KEY = fortigate

[fortigate_sourcetype]
REGEX = devname=.+fw.+device_id=
FORMAT = sourcetype::fortigate
DEST_KEY = MetaData:Sourcetype

[masonmorales]

In each of your transforms stanzas, you should also have:

SOURCE_KEY = MetaData:Sourcetype

[masonmorales]

Also, what are you trying to match with REGEX = |FireEye|? The pipe in REX acts as an OR operator, so if you have literal pipes, then you need to escape them with a backslash. If you don't have pipes, remove them as that may be part of the problem.