SEDCMD and metadata values

[cafissimo]

Hello, please, I would like to know if the SEDCMD command is able to change metadata values like host, source and sourcetype.

Thanks in advance.

[ziegfried · Accepted solution]

No, the SEDCMD option is only valid for the raw event text (ie. the _raw field).