Hi, I'm tring to change the sourcetype of all data of a specific source in props.conf [source::/var/log/messages] TRANSFORMS-change_sourcetype = syslog_sourcetype_change in transform.conf [syslog_sourcetype_change] SOURCE_KEY = MetaData:Sourcetype REGEX = .* FORMAT = sourcetype::syslog:nix DEST_KEY = MetaData:Sourcetype I checked the running config via btool and the stanzas are correctly configured on my heavy forwarder but it not works, the logs remain into syslog sourcetype Thanks in advance ... View more