Changing number of fields in transforms.conf but keeping original configuration for old data?

[claire_lee]

We currently have a scripted input that we originally configured using props.conf and transforms.conf stanzas like the ones below:

[events]
KV_MODE = none
CHECK_FOR_HEADER = false
REPORT-all-fields = eventsfields

[eventsfields]
DELIMS = "\t"
FIELDS = "time", "type", "message" 

Recently we changed the input to add in one additional field and changed transforms.conf to match:

[eventsfields]
DELIMS = "\t"
FIELDS = "id", "time", "type", "message" 

However, it looks like the new configuration has been retroactively applied to the events we had indexed previously and that do not contain the new 'id' field. What this means is that, in our old events, the time is now matched to the field name 'id', the type is now matched to the 'time' field, etc.

Is there any way to fix this by having the old events use the original configuration and the new events use the new one?

[gkanapathy]

There is not. In a case like this, where the log format changes, we would recommend a change in the sourcetype name to reflect new versions of the sourcetype. The new sourcetype would invoke a different transforms.conf rule.