Our input data has a field named conditions, which is comma-separated list. We wanted to assign eventtypes to the events according to the list inside. For example, conditions="WeightOK,TooBig"
would result in the event having two eventtypes: WeightOK
and TooBig
.
What would be the most efficient way of doing it? I don't think we could just have an evaluated field in props.conf
/transforms.conf
called eventtypes, could we? Eventtypes are normally defined in eventtypes.conf
. Would it work if we created a search-time calculated field, say, mv_conditions=split(conditions,",")
and then used
[app-%mv_conditions%]
search = <our search>
in eventtypes.conf
? And if yes, would it be efficient?
After a lot of experiments, I found that we'll have to:
a) tokenize the conditions
field with TOKENIZER = ([^,]+)
in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:
[WeightOK]
search = conditions=WeightOK
etc.
We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*
After a lot of experiments, I found that we'll have to:
a) tokenize the conditions
field with TOKENIZER = ([^,]+)
in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:
[WeightOK]
search = conditions=WeightOK
etc.
We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*