how to Transform/regex on already extracted field within same app?

[koshyk]

We have a ready made app with the configs in "default" (props & transforms).

The existing content is

[organisational_extraction_in_default]
DELIMS = ","
FIELDS = "fielda_with_complex_structure","field2","field3"

The above transform extracts perfectly, with all the fields correctly but the first field contains multiple other valuable information.
I want to further split fielda_with_complex_structure to make it into further key-value pairs. How can i create a transform on an already extracted field? I'm planning to put the new extraction login in "local", but I'm not sure how I can put the stanza name?

[woodcock · Accepted solution]

Like this:

In props.conf:

# These are executed in the same order that they appear in the list so ORDER CAREFULLY!
REPORT-mystuff = organisational_extraction_in_default, my_deeper_extraction_1, my_deeper_extraction_2, my_deeper_extraction_3

In transforms.conf:

[organisational_extraction_in_default]
DELIMS = ","
FIELDS = "fielda_with_complex_structure","field2","field3"

[my_deeper_extraction_1]
SOURCE_KEY=fielda_with_complex_structure
REGEX=(?<deep1_1>.*)

[my_deeper_extraction_2]
SOURCE_KEY=fielda_with_complex_structure
DELIMS = ","
FIELDS = deep2_1, deep2_2, deep2_3

[my_deeper_extraction_3]
SOURCE_KEY=fielda_with_complex_structure
REGEX = ^\/(?:[^\/]+\/){4}([^\/]+)
FORMAT = deep3_1::$1

[koshyk]

thanks a lot mate

[DalJeanis]

just to verify, this an index-time extraction (TRANSFORM-) , rather than a search-time extraction (REPORT-/EXTRACT-)?

[DalJeanis]

just to verify, this an index-time extraction (TRANSFORM-) , rather than a search-time extraction (REPORT-/EXTRACT-)?

[koshyk]

it is search-time