Hi,
I'm trying to replace the host value using a field in the data. I tried to find any previous similar solution but it's not working.
A sample of the data is here:
'##REC##;WWWDBDW;3221912927;wwwdbdw1;x52wwwdb01.domain.com;11.2.0.4.0;Linux x86 64-bit;00008481;25-Aug-16 12:00:01;25.40;0.00;0.00;0.00;964278.51;0.00;2.55;4.06;1.59'
props.conf
[www_general_stats]
TRANSFORMS-host = www_host
transforms.conf
[www_host]
SOURCE_KEY = _raw
DEST_KEY = Metadata::Host
FORMAT = host::$1
REGEX = ^(?:[^;\n]*;){4}(?P[^;]+)
Can anyone help me here, please?
I don't know what is "not working" (could be that it isn't finding the host properly and thus assigning something else in the field, or not assigning the host at all - you didn't really specify that). I do see two problems, one which was answered by rjthibod already and the other is the DEST_KEY. One colon instead of two:
DEST_KEY = MetaData:Host
I don't know what is "not working" (could be that it isn't finding the host properly and thus assigning something else in the field, or not assigning the host at all - you didn't really specify that). I do see two problems, one which was answered by rjthibod already and the other is the DEST_KEY. One colon instead of two:
DEST_KEY = MetaData:Host
The issue seems to be the upper case D of MetaData. Worked fine!
Thank you!
AND the single colon...
You don't need the ?P
part in your regex.
Use this instead: REGEX = ^(?:[^;\n]*;){4}([^;]+)