The problem was the target, target_port, and target_locality fields hadn't actually been set as MV fields by default. So by adding the following, it now works properly:
props.conf:
[cisco_ips_syslog]
REPORT-target = target,target_port,target_locality
transforms.conf:
[target]
REGEX = target=\"(.+?)\"
FORMAT = target::$1
MV_ADD = True
[target_port]
REGEX = target_port=\"(.+?)\"
FORMAT = target_port::$1
MV_ADD = True
[target_locality]
REGEX = target_locality=\"(.+?)\"
FORMAT = target_locality::$1
MV_ADD = True
... View more