I tried to setup 2 rules :
- one to rename the sourcetype A to B for some events
- one to apply a SEDCMD rule to the sourcetype B only.
But ultimately the SEDCMD never applied, it works only if I apply i to the sourcetype A.
[A]
TRANSFORMS-set_sourcetype_to_ssl_audit = force_sourcetype_to_B
[B]
SEDCMD-anonymize = s/SSN(\d+)/SSNxxx/g
transforms.conf
[force_sourcetype_to_B]
REGEX = BFTW
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::B
Is it linked to the order of the rules ?
As per @sowing comment.
The problem is that the 2 rules are for index time.
The first transform will apply renaming the sourcetype A to B.
But the event will not be parsed a second time (at index time) for the new sourcetype rules. Therefore the SEDCMD will never happen.
Remark: at search time. the new sourcetype rules may stilll apply ( by example a field extraction)
As per @sowing comment.
The problem is that the 2 rules are for index time.
The first transform will apply renaming the sourcetype A to B.
But the event will not be parsed a second time (at index time) for the new sourcetype rules. Therefore the SEDCMD will never happen.
Remark: at search time. the new sourcetype rules may stilll apply ( by example a field extraction)
Per this , both SEDCMD and transforms.conf happen during 'Typing' queue process and since data is coming for sourcetype A so configuration for A will take effect and configuration (index-time) for sourcetype B will never take place.
Make that an answer, and I'll vote it up. You get one pass at parsing rules, starting with the original sourcetype, top to bottom, left to right.