Our input data has a field named conditions, which is comma-separated list. We wanted to assign eventtypes to the events according to the list inside. For example, conditions="WeightOK,TooBig" would result in the event having two eventtypes: WeightOK and TooBig.
What would be the most efficient way of doing it? I don't think we could just have an evaluated field in props.conf/transforms.conf called eventtypes, could we? Eventtypes are normally defined in eventtypes.conf. Would it work if we created a search-time calculated field, say, mv_conditions=split(conditions,",") and then used
search = <our search>
in eventtypes.conf? And if yes, would it be efficient?
After a lot of experiments, I found that we'll have to:
a) tokenize the conditions field with TOKENIZER = ([^,]+) in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:
search = conditions=WeightOK
We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*