host_regex question for multiple matching fields

[ianathompson]

I am trying to set my host name equal to part of the file name with a regex (regular expression) and I am a regex novice.

The filename is FIRST01_USELESSWORD_SECOND01_YEAR_MONTH_DAY.log. I want the host name to be FIRST01SECOND01. I can get a simple regex to pull out both of the fields with a (FIRST\d+)\w+(SECOND\d+)_ . I even tried (FIRST\d+|SECOND\d+)_ but I still only get the FIRST\d+ as the host name.

I have a second file that is FIRST_USELESSWORD_1_YEAR_MONTH_DAY.log that I am trying to the host name to be FIRST1, but am having the same issue. I don't know if a lookback or lookahead is needed. Basically, I am just at loss because of my lack of regex experience.

Any help is appreciated. Thanks.

[dwaddle]

You can't do this with the host_regex shortcut. It only groks the one capture group, and doesn't give you a good way to "filter out" USELESSWORD.

You should be able to do this in the config files though.

In props.conf:

[mysourcetype]
TRANSFORMS-host=my_awesome_host_transform

In transforms.conf:

[my_awesome_host_transform]
SOURCE_KEY = MetaData:Source
DEST_KEY = MetaData:Host
REGEX = .*/(FIRST01)_USELESSWORD_(SECOND01)_
FORMAT = host::$1$2