I am trying to set my host name equal to part of the file name with a regex (regular expression) and I am a regex novice.
The filename is FIRST01_USELESSWORD_SECOND01_YEAR_MONTH_DAY.log. I want the host name to be FIRST01SECOND01. I can get a simple regex to pull out both of the fields with a (FIRST\d+)\w+(SECOND\d+)_ . I even tried (FIRST\d+|SECOND\d+)_ but I still only get the FIRST\d+ as the host name.
I have a second file that is FIRST_USELESSWORD_1_YEAR_MONTH_DAY.log that I am trying to the host name to be FIRST1, but am having the same issue. I don't know if a lookback or lookahead is needed. Basically, I am just at loss because of my lack of regex experience.
Any help is appreciated. Thanks.
You can't do this with the host_regex
shortcut. It only groks the one capture group, and doesn't give you a good way to "filter out" USELESSWORD.
You should be able to do this in the config files though.
In props.conf:
[mysourcetype]
TRANSFORMS-host=my_awesome_host_transform
In transforms.conf:
[my_awesome_host_transform]
SOURCE_KEY = MetaData:Source
DEST_KEY = MetaData:Host
REGEX = .*/(FIRST01)_USELESSWORD_(SECOND01)_
FORMAT = host::$1$2