We use a transform.conf file with regex to extract the field values. However, the field name in the data input is not in human-readable format. But each value is predictable and we have a reference csv that would allow us to correlate these data together.
FIELDALIAS-<class> = (<orig_field_name> AS <new_field_name>)
Use this to apply aliases to a field. The original field is not removed.
This just means that the original field can be searched on using any of
You can create multiple aliases for the same field.
<orig_field_name> is the original name of the field.
<new_field_name> is the alias to assign to the field.
You can include multiple field alias renames in the same stanza.
Field aliasing is performed at search time, after field extraction, but
before calculated fields (EVAL-* statements) and lookups.
This means that:
* Any field extracted at search time can be aliased.
* You can specify a lookup based on a field alias.
* You cannot alias a calculated field.