Forward certain items to indexer and then split into multiple indexes.

[tachu]

I've got a heavy forwarder that is filtering out lines from a monitor. and the rest is being send to nullQueu

props.conf

[source1]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
MAX_TIMESTAMP_LOOKAHEAD=35
pulldown_type = 1
TRANSFORMS-set= setnull,setparsing

transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = (?i)event=(event1|event2)
DEST_KEY = queue
FORMAT = indexQueue

in my indexer i did this

props.conf

[source1]
TRANSFORMS-index = splitevent1,splitevent2
EXTRACT-ip = ^(?P<ip>[^,]+)

transforms.conf

[splitevent1]
REGEX = (?i)event1
DEST_KEY = _MetaData:Index
FORMAT = event1index

[splitevent2]
REGEX = (?i)event2
DEST_KEY = _MetaData:Index
FORMAT = event2index

events are still going to the main index. and my defined indexes event1index and event2index are empty.. any ideas???

[dshpritz · Accepted solution]

Have you tried adding the same configs that are on the indexer to the heavy forwarder?

Dave