What would be the regex to map the host to my incoming data?

[a212830]

I want to map the host to data coming in and need help with the regex to put in transforms.conf.

The data is:

metric_name=xen.cpu0 timestamp=1420641286 value=0.0007 uuid=56fb671c-4824-a537-fbda-725547d6d980 vmname=anythinghere.abc.com

I want to map vmname to host. What would the regex be for that?

[chanfoli · Accepted solution]

The following seems like a simple approach which is worth a try for the REGEX part of the stanza :

REGEX = vmname=(\S+)

of course you would also use the following for overriding the host metadata in the appropriate transforms stanza:

FORMAT = host::$1
DEST_KEY = MetaData:Host