I'm looking to set up a field transformation (with no access to transforms.conf) for my department's logs to be able to differentiate our data centers and environments. For some reason, the configuration I've put in doesn't appear to be working, though no errors are returned.
Setup (made generic):
When I run a given search for my logs, however, I'm not seeing the field env or the field datacenter.
I've also double-checked my regex and checked with a couple
Is there some inherent misunderstanding in this setup? Is it not possible to do this against 'tag::host' as a source key?
Any and all help is appreciated!!!
~ Jen