I am trying to take a TCP feed that is setting sourcetype=sources, and want to split the events into separate indexes and sourcetypes based on their content. However, this is not working for me.
Configs are below, and are located on the heavy forwarder. Any ideas?
[sources]
TRANSFORMS-reassign = fireeye_index,fireeye_sourcetype,fortigate_index,fortigate_sourcetype
[fireeye_index]
DEST_KEY =_MetaData:Index
REGEX = |FireEye|
FORMAT = fireeye
[fireeye_sourcetype]
REGEX = |FireEye|
FORMAT = sourcetype::fireeye
DEST_KEY = MetaData:Sourcetype
[fortigate_index]
DEST_KEY =_MetaData:Index
REGEX = devname=.+fw.+device_id=
DEST_KEY = fortigate
[fortigate_sourcetype]
REGEX = devname=.+fw.+device_id=
FORMAT = sourcetype::fortigate
DEST_KEY = MetaData:Sourcetype
In each of your transforms stanzas, you should also have:
SOURCE_KEY = MetaData:Sourcetype
Also, what are you trying to match with REGEX = |FireEye|
? The pipe in REX acts as an OR operator, so if you have literal pipes, then you need to escape them with a backslash. If you don't have pipes, remove them as that may be part of the problem.