Hi All
I'm hoping someone might have an insight into a problem I'm having extracting fields from some XML based event data -- essentially I can only extract the first of 2 potential fields; the second field fails to be extracted and made available in the search app.
Example of the data I'm indexing:
<metrics>
<metric>
<name>diskavailablespaceC</name>
<value>1</value>
</metric>
<metric>
<name>diskavailablespaceE</name>
<value>7</value>
</metric>
</metrics>
My config files:
props.conf
[Power_test1]
TRANSFORMS-disk_available = disk_available
transforms.conf
[disk_available]
REGEX = (?i)<name>diskavailablespace(\w)</name>\s*?<value>(\d)</value>
FORMAT = $1::$2
WRITE_META = true
Some observations:
<metric>
tags around, I extract a single field 'E' with value 7, suggesting to me that the regex is either failing or not being applied beyond the first match (??). <metric>
tag.REPEAT_MATCH = true
attribute with no change in behaviour.I would appreciate any suggestions as to what may be going on, or what I might do to achieve the expected field extraction.
Many Thanks, B
Two things:
MV_ADD
directive in transforms.conf
. From the docs:``
MV_ADD = [true|false]
* NOTE: This attribute is only valid for search-time field extractions.
* Optional. Controls what the extractor does when it finds a field which already exists.
* If set to true, the extractor makes the field a multivalued field and appends the
* newly found value, otherwise the newly found value is discarded.
* Defaults to false