Hi all,
We are trying to do the following:
At index time we want to use 4 regex TRANSFORMS to store values in two fields.
The issue I am running into is that I only want to keep the results from the regex that was not empty and not write the matches from the regex that matched before.
Here is our current set-up:
props.conf
TRANSFORMS-test= test1,test2,test3,test4
outputs.conf
[test1]
REGEX = \S{3}.\d{1,2}.\d{1,2}\:\d{1,2}\:\d{1,2}.(([a-zA-Z0-9]{1,5}-){1,5}\S{1,3}).([\S\s]+)
WRITE_META = true
FORMAT = message_type::empty message::$2
[test2]
REGEX = \S{3}\s\d{1,2}\s\d{1,2}\:\d{1,2}\:\d{1,2}\s(([a-zA-Z0-9]{1,5}-){1,5}\S{1,3})\s([\S]+):\s([\S\s]+)
WRITE_META = true
FORMAT = message_type::$1 message::$2
[test3]
REGEX = \S{3}\s\d{1,2}\s\d{1,2}\:\d{1,2}\:\d{1,2}\.\d{1,3}\s([\S]+):\s([\S\s]+)
WRITE_META = true
FORMAT = message_type::$1 message::$2
[test4]
REGEX = (%|-)([\S]+):\s([\S\s]+)
WRITE_META = true
FORMAT = message_type::$1 message::$2
Is there a way to combine the regex that runs so that only the last one with actual values is written?
I tried using these in a an SPL, and as long as I did not use the same field names, I got the results. I was not able to combine it, the reason for index time is being able to use tstats.
Any help is appreciated.
... View more