Hi,
I have the following transforms.conf:
[REPLACEMENT_COST]
CLEAN_KEYS = 0
FORMAT = $1"REPLACEMENT_COST2":"$2$s"$3
REGEX = (.*)"REPLACEMENT_COST":([^,]+)(.*)
#SOURCE_KEY = REPLACEMENT_COST
DEST_KEY = _raw
I had to write s in the FORMAT field right after $, since otherwise, it does nothing. Is there any option to escape the dollar sign in this field?
The relevant props.conf is:
[json_multiline]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
LINE_BREAKER = ([\r\n]+)
MAX_DAYS_AGO = 10000
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = LAST_UPDATE
TIME_FORMAT = %m/%e/%y %H:%M
category = Custom
pulldown_type = 1
disabled = false
KV_MODE = none
EVAL-DESCRIPTION = replace(DESCRIPTION, "([A-Z])", " \1")
EVAL-SPECIAL_FEATURES = split(replace(SPECIAL_FEATURES, "([A-Z])", " \1"), ",")
LOOKUP-LANGUAGE = LANGUAGE.csv LANGUAGE_ID
TRANSFORMS-REPLACEMENT = REPLACEMENT_COST
Thanks
Hi
usually character \ has used for escape character. I haven't try if this works also in your case, but you could try it like "\$" in your transforms.conf and see if it works or not.
r. Ismo
Hi,
Thank you, but I tried and it doesn't work.
Thanks