set host value based on event

[tuxford]

Hello

I'm trying to set host based on value in an event, but it uses the default value and I'm trying to figure out why that is. My config looks like this:

transforms.conf

[janus]
DEST_KEY=MetaData:Host
REGEX=((?<=\d\d:\d\d:\d\d\s)[\w-\.]+)
FORMAT=host::$1

props.conf

[source::/var/log/syslog_vpn]
TRANSFORMS-janus=janus
SHOULD_LINEMERGE=false
sourcetype=vpn

[source::/var/log/syslog_info]
TRANSFORMS-janus=janus
SHOULD_LINEMERGE=false
sourcetype=ciscone

inputs.conf

[monitor:///var/log/syslog_info]
index=test

[monitor:///var/log/syslog_vpn]
index=test

I know my regex works since I've tested it with this rex in my search that replaces all the hostnames within the event to XXX: rex mode=sed "s/((?<=\d\d:\d\d:\d\d\s)[\w-\.]+)/XXX/g"

[tuxford]

So I finally figured it out, the config that I tried were put on the universal forwarder and was not honored, when put on the indexer it was all good.

[MuS]

Hi tuxford, without tweaking the UF ignores props.conf and transforms.conf. Good you figured it out 😉