I have events like this comin from Heavy forwarder "geo": {"continent": "NA", "country": "UK", "city": "LONDON"}, "hostname": "xxxx xxx xxxx" I have to override the host metadata with the hostname field from the event. my transforms.conf [hostoverride] SOURCE_KEY = hostname REGEX = (.*) DEST_KEY = MetaData:Host FORMAT = host::$1 props.conf [sourcetypename] . . . TRANSFORMS-hostoverride = hostoverride In some of the events I am still getting the Heavy forwarder name. Thanks for the help in Advance
... View more