Hi, I'm doing some research for our new architecture and am currently doing some house keeping on our props and transforms.
If we have a regex for a sourcetype, is it faster to put the regex in the transforms or in the props and use line_breaker? Traditionally, we just set should_linemerge to false in the props and then put the regex in the transforms and link it via report in the props. However, I just read something that said doing regular expressions in line_breaker causes a performance increase.
Could someone provide a clear explanation on this for me?
... View more