How to use conditional regex in transforms.conf to capture the hostname based on field criteria?

[arizviherjavec]

Here's a sample Log:

Mar  2 09:27:24 Blue_Firewall 1,2018/03/02 09:27:24,00546543517,THREAT,url,1,2018/03/02 09:27:18,102.12.40.148,11.0.54.3,32.0.01.34,121.120.54.3,DG_OUT_Internet-WebBrowse_Allow,arkansas\joeblo,,ssl,vsys1,Genius,Untrust_L3,ethernet1/2.40,ethernet1/1,Fwd-to-Some-Zone,2018/03/02 09:27:18,1662,1,51096,443,44426,443,0x40b000,tcp,alert,"amers2.apps.cp.thomsonreuters.com/",(9999),business-and-economy,informational,client-to-server,757565465,0x8000000000000000,10.0.0.0-10.255.255.255,United States,0,,0,,,0,,,,,,,,0,13,0,0,0,,Firewall-Name,,,,,0,,0,,N/A,unknown,AppThreat-0-0,0x0

So here's what I want,

If "Red-Firewall" or "Green-Firewall" exists near the bottom of the log (where it says "Firewall-Name"), I want the hostname to be Red-... or Green-..., however, if there is any OTHER name there, or that field is empty, I want it to use whatever is at "Blue_Firewall" location as the hostname.

So far, when there was only 2, I could easily use

REGEX=\,(Red-Firewall|Green-Firewall)\,
FORMAT=host::$1
DEST_KEY=MetaData:Host

Now, I cannot.

Any ideas?

[FrankVl]

If you use the "blue_firewall" hostname as the default option and then overwrite it with that config you already had, that should work, right? If the regex for red/green doesn't match, it will keep the current hostname value.