I am trying to extract some values from the Host field. For example, variations of host name being:
labAppdev03, labWebdev01, labDocDev02. What I am trying to get is App, Web or Doc as a role field out of host name field.
What I have so far:
transforms.conf:
[role]
SOURCE_KEY=MetaData:Host
REGEX=host::*(App|Web|Doc)*
FORMAT=role::app
WRITE_META=true
Props.conf:
[sourceone]
TRANSFORMS-role=role
For FORMAT
, it should reference the number of the capture group in your regular expression (i.e., which set of parentheses are you looking in). You only need WRITE_META for index-time field extractions, which are usually best avoided. Similarly, you can just use host
here in SOURCE_KEY, since it will be a normal field at that point. Last, for your regex - either use .*
to match multiple characters, or just leave it out completely since you're already matching anywhere within the hostname.
Try:
#transforms.conf
[role]
SOURCE_KEY=host
REGEX=(App|Web|Doc)
FORMAT=role::$1
#props.conf:
[sourceone]
TRANSFORMS-role=role