Hi,
I need to extract multiple fields (from events that are coming via HEC) and assign an index based on the concatenated values.
(I know that you can assign index per HEC token, but let's assume that all the events are coming with the same token)
Example payload
{
"sourcetype": "hec:generic",
"event": {
"platform": "platform01",
"service": "service02",
"env": "npd",
"type": "alert",
"test": "true",
"message": "TEST HEC 040"
}
}
i've figured out how to do it if I know the order
props.conf
[hec:generic]
TRANSFORMS-index_selector = index_selector
transforms.conf
[index_selector]
REGEX = platform"\s?:\s?"(?P<platform>\w+)",\n\s*"service"\s?:\s?"(?P<service>\w+)",\n\s*"env"\s?:\s?"(?P<env>\w+)
DEST_KEY = _MetaData:Index
FORMAT = $1_$2_$3
But what if I don't know the order of the platform , service and env fields?
Any suggestions?
Can I somehow have 3 separate REGEX lines?
Tried below
REGEX = platform"\s?:\s?"(?P<platform>\w+)
REGEX = service"\s?:\s?"(?P<service>\w+)
REGEX = env"\s?:\s?"(?P<env>\w+)
DEST_KEY = _MetaData:Index
FORMAT = $1_$2_$3
and the result it just picks up the last REGEX, so basically it tries to assign "npd_$2_$3" to index
... View more