search time extraction on specific index

[dgnatowski]

I have 2 data inputs going to 2 separate indexes.  I have 2 different REGEX expressions to obtain IPAddress and Hostname.  How can I make it so only regex#1 is executed for index#1 and regex#2 is executed for index#2?  I have used EXTRACT and REPORT entries in props.conf to perform search-time field extractions, but both regex expressions get executed and I get erroneous data for IPAddress and Hostname fields.

What's the best way to handle this situation?

Sample data from data input #1:

Feb 1 14:15:17 10.106.198.22 1 2021-02-01T19:07:01.490Z w2k19_02.xxxBD.local

Sample data from data input #2:

Feb 1 14:46:43 10.106.5.72 Feb 1 19:53:23 vCM_01.xxxbd.local appliance: <134>1 2021-02-01T19:53:18.318369Z vCM_01.xxxbd.local

[tscroggins]

@dgnatowski 

Ensure you have properly defined hosts, sources, or source types for each event. After that, define your field extractions for the correct host, source, or source type. The index containing the event isn't normally relevant.

In your case, input #1 and input #2 have different formats and should be defined as different source type. If you're using a common source type, e.g. syslog, then define your extractions based on host or source.