How to index routing based on the data in raw event?

[ainap]

I had the following scenario working in one clustered environment, using physical servers:

1. Route data to an index based on the value found in a raw data. 

This is achieved by, using props and transforms conf that are deployed within a parsing app, that looks something like this:

props.conf

[a_somercetype]

TRANSFORMS-index_routing = a_index_routing

[b_sourcetype]
TRANSFORMS-index_routing = b_index_routing

transforms.conf:

[index_routing]
SOURCE_KEY = _raw
REGEX = ^\d{4}\-\d{2}-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d+\+\d{2}\:\d{2}\s\w+\.\w+\.bb\-(?<field1>\w+?)\-
DEST_KEY = _MetaData:Index
FORMAT = index_name_$1

note: field1 is where value a or b will appear

There is also inputs.conf on the deployment server that pushes the config with correct index and sourcetype to the forwarder. This used to work without any issues. In fact still does in one of the clustered environment. But it doesn't work in the new test clustered environment as the data gets sent to main index instead of the indexes specified in props and transforms. Is there a setting on the indexer or elsewhere that could stop this from working?

[PickleRick]

As a side note - if you're using $1, you don't need to name the group.

But to the point. Generally, it should work. Are you 100% sure that your events in this environment do match the regex?

And is it a mistake in copy-pasting? Because in props.conf you have two differently named transforms and the stanza from transforms.conf is named differently.

[ainap]

yes, all configuration is exactly the same and is working on one clustered environment but not the other one, which makes no sense. The data is coming in exactly the same format and I can see that regex matches the correct value in the raw event. 

[ainap]

I should have mentioned earlier that instead of data being routed to the indexes as specified in transforms and props.conf, it is being sent to main.

[PickleRick · Accepted solution]

Just to be on the safe side - a basic question - you put the props/transforms on the first "heavy" component in event's path?

Did you check the resulting config with btool?

[ainap]

Thank you for your help. You are right, put props/transforms onto first heavy component, which we didn't. The new set up includes heavy forwarder.  The config was placed as of previous set up in place and not considered new set up. Silly mistake. Thanks.