We have a ready made app with the configs in "default" (props & transforms).
The existing content is
[organisational_extraction_in_default]
DELIMS = ","
FIELDS = "fielda_with_complex_structure","field2","field3"
The above transform extracts perfectly, with all the fields correctly but the first field contains multiple other valuable information.
I want to further split fielda_with_complex_structure
to make it into further key-value pairs. How can i create a transform on an already extracted field? I'm planning to put the new extraction login in "local", but I'm not sure how I can put the stanza name?
Like this:
In props.conf:
# These are executed in the same order that they appear in the list so ORDER CAREFULLY!
REPORT-mystuff = organisational_extraction_in_default, my_deeper_extraction_1, my_deeper_extraction_2, my_deeper_extraction_3
In transforms.conf:
[organisational_extraction_in_default]
DELIMS = ","
FIELDS = "fielda_with_complex_structure","field2","field3"
[my_deeper_extraction_1]
SOURCE_KEY=fielda_with_complex_structure
REGEX=(?<deep1_1>.*)
[my_deeper_extraction_2]
SOURCE_KEY=fielda_with_complex_structure
DELIMS = ","
FIELDS = deep2_1, deep2_2, deep2_3
[my_deeper_extraction_3]
SOURCE_KEY=fielda_with_complex_structure
REGEX = ^\/(?:[^\/]+\/){4}([^\/]+)
FORMAT = deep3_1::$1
Like this:
In props.conf:
# These are executed in the same order that they appear in the list so ORDER CAREFULLY!
REPORT-mystuff = organisational_extraction_in_default, my_deeper_extraction_1, my_deeper_extraction_2, my_deeper_extraction_3
In transforms.conf:
[organisational_extraction_in_default]
DELIMS = ","
FIELDS = "fielda_with_complex_structure","field2","field3"
[my_deeper_extraction_1]
SOURCE_KEY=fielda_with_complex_structure
REGEX=(?<deep1_1>.*)
[my_deeper_extraction_2]
SOURCE_KEY=fielda_with_complex_structure
DELIMS = ","
FIELDS = deep2_1, deep2_2, deep2_3
[my_deeper_extraction_3]
SOURCE_KEY=fielda_with_complex_structure
REGEX = ^\/(?:[^\/]+\/){4}([^\/]+)
FORMAT = deep3_1::$1
thanks a lot mate
just to verify, this an index-time extraction (TRANSFORM-) , rather than a search-time extraction (REPORT-/EXTRACT-)?
just to verify, this an index-time extraction (TRANSFORM-) , rather than a search-time extraction (REPORT-/EXTRACT-)?
it is search-time