How replace host using a field

[tamakg]

Hi,

I'm trying to replace the host value using a field in the data. I tried to find any previous similar solution but it's not working.

A sample of the data is here:

'##REC##;WWWDBDW;3221912927;wwwdbdw1;x52wwwdb01.domain.com;11.2.0.4.0;Linux x86 64-bit;00008481;25-Aug-16 12:00:01;25.40;0.00;0.00;0.00;964278.51;0.00;2.55;4.06;1.59'

props.conf
[www_general_stats]
TRANSFORMS-host = www_host

transforms.conf
[www_host]
SOURCE_KEY = _raw
DEST_KEY = Metadata::Host
FORMAT = host::$1
REGEX = ^(?:[^;\n]*;){4}(?P[^;]+)

Can anyone help me here, please?

[cpetterborg · Accepted solution]

I don't know what is "not working" (could be that it isn't finding the host properly and thus assigning something else in the field, or not assigning the host at all - you didn't really specify that). I do see two problems, one which was answered by rjthibod already and the other is the DEST_KEY. One colon instead of two:

DEST_KEY = MetaData:Host

[tamakg]

The issue seems to be the upper case D of MetaData. Worked fine!

Thank you!

[tamakg]

AND the single colon...

[rjthibod]

You don't need the ?P part in your regex.

Use this instead: REGEX = ^(?:[^;\n]*;){4}([^;]+)