It should read as woodcock mentioned. "Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones CAN update/overwrite that original value."   ... View more

Another thought: in my example, isn't event-id a field extracted at search time? Shouldn't it pick up changes to source and sourcetype , which are made during indexing? ... View more

Hey, nope, sorry, I never followed-up on this. ... View more