Hi, Is it possible using props.conf and transforms.conf to route some data on an index based on the source field? Let's say index1 contains a lot of sources, in some sources it contains certain words in the path for example (source="*dev-ksm*" OR source="*int-ksm*" OR source="*qa-ksm*" OR source="*amq-*-ksm*") For this scenario I'd like to route events that their source contains the above matching sources to an index2 Was thinking in something like this: props.conf [index::current_index]
TRANSFORMS-routing=filter-to-new_index transforms.conf [filter-to-new_index]
DEST_KEY = _MetaData:Index
SOURCE_KEY = MetaData:Source
REGEX = (?i)(.*dev-ksm.*|.*int-ksm.*|.*qa-ksm.*|.*amq-.*-ksm.*)
FORMAT = new_index Does not seem to be currently working. Hence the question if its possible to do something like this. Thanks in advance.
... View more