transforms.conf use two conditions

[rex_rafa]

I have an event in index xxx with events coming from different hosts.
I need to create a transforms.conf to filter when the event has a specific word than I route for another index.

transforms.conf
[abc]
REGEX = debug
DEST_KEY = _MetaData:Index
FORMAT = debug

That config works well to filter the word and send it to the correct index, but I need to send for this index only words for specifics hosts.
Like that:
If I have debug AND host=this_host send to index debug.
How I can do that?

[marycordova]

Have you tried the MetaData::Host key?

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf?utm_source=answers&utm_medi...