my transforms.conf has such lines
[api-param]
REGEX=^(\w+)=(.+?)\n
FORMAT=$1::$2
props.conf
[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
REPORT-st = api-param
why I've got strange fields with values $2
like index=* OK="$2" on event
2018-10-01 22:21:55,812 INFO [ 891] [AsopApi]
----------------------------
requestID=Server@1538421715802-1570361
messageID=MetroRequest@1538421715802-865639
actor=Asop->
api=AsopApi
method=asop_wr_start
type=response
elapsed=0.010
cardUID=048E48820F5D80
cardNumber=0021642560
trxID=181000000365323654
trxPCID=2EF20F6318CBEA4774DFAE6E1D18B52D
session=230873148
trxPaymentPCID=EE21AF76139B982D2CFA642BB05DC09F
trxPaymentTime=2018-10-01T22:19:11.332
result=OK
<?xml version="1.0" encoding="windows-1251"?><message><head><api_version>1.1</api_version><msg_id>230873148</msg_id><code>0</code><comment></comment><time>2018-10-01T22:21:55</time></head><body><new_balance>90.0</new_balance></body></message>
----------------------------
or index=* 0003191276="$2" on
2018-10-01 22:18:24,645 INFO [ 49] [AsopAeroexpressApi]
----------------------------
requestID=Server@1538421504531-1565469
messageID=MetroRequest@1538421504552-863049
actor=->Asop
api=AsopAeroexpressApi
method=cott_ewd_start
type=response
elapsed=0.089
cardUID=043B8D0A7F3580
cardNumber=0003191276
trxID=181000000365322716
trxPCID=14402F29670CE347D6724DC5631825D9
agent=torgwc
result=OK
headers={content-length=664, content-type=text/xml;charset=windows-1251, pragma=no-cache}
<?xml version="1.0" encoding="WINDOWS-1251"?>
<message>
<head>
<api_version>1.0</api_version>
<msg_id>14402F29670CE347D6724DC5631825D9</msg_id>
<code>0</code>
<comment></comment>
<time>2018-10-01T22:18:25</time>
</head>
<body>
<res_code>0</res_code>
<balance>675.00</balance>
<blocks>
<block>
<number>0</number>
<data>RdsQAwsezhlqYqQAAAAAAA==</data>
</block>
<block>
<number>1</number>
<data>NSgsM4wAFABB6xQAHKURbw==</data>
</block>
<block>
<number>2</number>
<data>NSgsM4wAFABB6xQAHKURbw==</data>
</block>
</blocks>
</body>
</message>
