transforms.conf and props.conf

[fi5033]

I am trying to extract some values from the Host field. For example, variations of host name being:
labAppdev03, labWebdev01, labDocDev02. What I am trying to get is App, Web or Doc as a role field out of host name field.

What I have so far:

transforms.conf:

[role]
SOURCE_KEY=MetaData:Host
REGEX=host::*(App|Web|Doc)*
FORMAT=role::app
WRITE_META=true

Props.conf:

[sourceone]
TRANSFORMS-role=role

[southeringtonp]

For FORMAT, it should reference the number of the capture group in your regular expression (i.e., which set of parentheses are you looking in). You only need WRITE_META for index-time field extractions, which are usually best avoided. Similarly, you can just use host here in SOURCE_KEY, since it will be a normal field at that point. Last, for your regex - either use .* to match multiple characters, or just leave it out completely since you're already matching anywhere within the hostname.

Try:

#transforms.conf
[role]
SOURCE_KEY=host
REGEX=(App|Web|Doc)
FORMAT=role::$1

#props.conf:
[sourceone]
TRANSFORMS-role=role