I want to mask only data in my test indexes (I have both prod and test indexes on 1 indexer server)
Can I do so? As I can see the masking is applied to all my indexes with data from a specified spurcetype.
Ex:
props.conf:
[source::...\access.log*]
sourcetype = access_common
transform.conf:
[access_common]
SE-msi1 = q/(\/eb\/res\/rec\/Number\/\d{2})\d{4}/\1xxxx/
Given your clarification:
Some host are test and some are prod - the filename is the same but the paths are different
Then you can do this:
[source::.../UniqueSegmentOfTestPath/...]
sourcetype = access_common_filter_first
[source::.../UniqueSegmentOfProductionPath/...]
sourcetype = access_common
[access_common_filter_first]
SE-msi1 = q/(/eb/res/rec/Number/d{2})d{4}/1xxxx/
rename = access_common
Given your clarification:
Some host are test and some are prod - the filename is the same but the paths are different
Then you can do this:
[source::.../UniqueSegmentOfTestPath/...]
sourcetype = access_common_filter_first
[source::.../UniqueSegmentOfProductionPath/...]
sourcetype = access_common
[access_common_filter_first]
SE-msi1 = q/(/eb/res/rec/Number/d{2})d{4}/1xxxx/
rename = access_common
What discriminates test vs. prod? Is there a difference in the path/file? Are some hosts prod and some test?
Some host are test and some are prod - the filename is the same but the paths are different
Since both prod and test are on same server and surely, they will have same sourcetype and can have same source, try to setup the masking based on host (in props.conf).