I have data like this:
one_field="value_a|value_b|value_c", other_field="value_x|value_y"
How can I instruct MV_ADD to convert fields within such data to multivalue fields including auto-splitting value at '|'?
Apparently I don't even need MV_ADD, this solution seems to work:
Adding this to ./etc/system/local/fields.conf
:
[one_field]
TOKENIZER = ([^\|]+)
[other_field]
TOKENIZER = ([^\|]+)
Ideally though I'd love to limit such transformation to specific sourcetype or index, instead of doing it globally. Not sure it's possible with fields.conf-based solution.