What value of dest_key should be used for custom field extractions?

[ankithreddy777]

During index time field extractions, what value of DEST_KEY should be used for custom field extractions as there is no default?

[somesoni2 · Accepted solution]

If you're adding a custom field extraction as index time (not overwriting existing metadata/default fields like host, source, sourcetype, _raw), and setting WRITE_META = true and providing custom field name in REGEX or FORMAT attribute, then DEST_KEY is not required.