I'm looking to set up a field transformation (with no access to transforms.conf) for my department's logs to be able to differentiate our data centers and environments. For some reason, the configuration I've put in doesn't appear to be working, though no errors are returned.
Setup (made generic):
- A tag is configured on 'host' to be one of the following: app_prod_njw, app_prod_bel, app_preprod_njw, or app_preprod_bel
- A new private field transformation has been created with the following configuration:
- name: app-env-datacenter
- type: regex-based
- Regular expression: app_(?<env>\w+)_(?<datacenter>.+)
- Format: env::$1 datacenter::$2
- Source key: tag::host
- "Create multivalued fields" is not selected
- "Automatically clean field names" is not selected
When I run a given search for my logs, however, I'm not seeing the field env or the field datacenter.
I've also double-checked my regex and checked with a couple
Is there some inherent misunderstanding in this setup? Is it not possible to do this against 'tag::host' as a source key?
Any and all help is appreciated!!!
~ Jen
