proper way to apply props.conf rules on a modified sourcetype, and other fun stories

[yannK]

I tried to setup 2 rules :
- one to rename the sourcetype A to B for some events
- one to apply a SEDCMD rule to the sourcetype B only.

But ultimately the SEDCMD never applied, it works only if I apply i to the sourcetype A.

[A] 
TRANSFORMS-set_sourcetype_to_ssl_audit = force_sourcetype_to_B 

[B] 
SEDCMD-anonymize = s/SSN(\d+)/SSNxxx/g 

transforms.conf

[force_sourcetype_to_B] 
REGEX = BFTW
DEST_KEY = MetaData:Sourcetype 
FORMAT = sourcetype::B 

Is it linked to the order of the rules ?

[yannK · Accepted solution]

As per @sowing comment.

The problem is that the 2 rules are for index time.
The first transform will apply renaming the sourcetype A to B.
But the event will not be parsed a second time (at index time) for the new sourcetype rules. Therefore the SEDCMD will never happen.

Remark: at search time. the new sourcetype rules may stilll apply ( by example a field extraction)

[somesoni2]

Per this , both SEDCMD and transforms.conf happen during 'Typing' queue process and since data is coming for sourcetype A so configuration for A will take effect and configuration (index-time) for sourcetype B will never take place.

[sowings]

Make that an answer, and I'll vote it up. You get one pass at parsing rules, starting with the original sourcetype, top to bottom, left to right.