I want to map the host to data coming in and need help with the regex to put in transforms.conf.
The data is:
metric_name=xen.cpu0 timestamp=1420641286 value=0.0007 uuid=56fb671c-4824-a537-fbda-725547d6d980 vmname=anythinghere.abc.com
I want to map vmname to host. What would the regex be for that?
The following seems like a simple approach which is worth a try for the REGEX part of the stanza :
REGEX = vmname=(\S+)
of course you would also use the following for overriding the host metadata in the appropriate transforms stanza:
FORMAT = host::$1
DEST_KEY = MetaData:Host
View solution in original post