Creating new field from raw event

[RSS_STT]

i want to create new index time field severity if raw json payload have level field value is Information.

{ "level": "Information", "ORIGIN_Severity_name": "CRITICAL", "ProductArea": "Application", "ORIGIN_Product": "Infrastructure"}

What's wrong in my transforms.conf configuration. Any help much appreciated.

transforms.conf

[severity]
REGEX = "level":\s\"(?<severity>\w+)
SOURCE_KEY = fields:level
FORMAT = severity::"INFO"
WRITE_META = true

[livehybrid]

Hi @RSS_STT 

The issue here is the source_key which is incorrectly set, it should be set to _raw, although _raw is the default so you could just remove that line entirely.

You also do not need to specify the naming of the extraction in the REGEX and instead use $1, so your resulting transform will look like:

[severity]
REGEX = "level":\s\"(\w+)
FORMAT = severity::"$1"
WRITE_META = true

Please let me know how you get on and consider upvoting/karma this answer if it has helped.
Regards

Will

[RSS_STT]

it helped but how can ensure that it's create severity = INFO field only when level=Information.

[livehybrid]

Oh I see, sorry.

In that case you could do:

[severity]
REGEX = "level":\s\"(Informational)
FORMAT = severity::INFO
WRITE_META = true

This means it will only set the severity field (to INFO) when level=Informational - Is this what you want, or should it be other values if not Informational?

Is there a particular reason you are looking to make this index-time instead of a search-time change?