Hi @LittleFatFish , in this case, check if the sourcetype in props.conf is correct and especially if it's overrided, maybe when the transformation is applied your events still have the original sourcetype. Then obviously (but I'm sure that you already did it) check again the regex in transforma.conf. Ciao. Giuseppe ... View more