Can I have a REPORT line AND an EXTRACT LINE in my props.conf for a sourcetype even if the report is for a delimited list?
My proxy logs have a field named proxy_sourceip_sourceport. That is extracted fine via the REPORT line because the logs are tab delimited.
Can I have an EXTRACT based on that field alone or do I have to do it for the whole line?
It is not working an they are in alphabetical order.
Props:
[proxylogs]
REPORT-proxy_delim_tab = proxy_search
EXTRACT-proxy_src_ip = (?<proxy_src_ip>.+?): in proxy_sourceip_sourceport
Transforms:
[proxy_search]
CLEAN_KEYS = false
DELIMS = \t
FIELDS = proxy_sourceip_sourceport, proxy_time, proxy_url, etc
A better idea would be to use REPORT for your second extraction as well.
props.conf:
[proxylogs]
REPORT-proxy_fields = proxy_search, proxy_src_ip
transforms.conf:
[proxy_search]
CLEAN_KEYS = false
DELIMS = \t
FIELDS = proxy_sourceip_sourceport, proxy_time, proxy_url, etc
[proxy_src_ip]
SOURCE_KEY = proxy_sourceip_sourceport
REGEX = (.+?):
FORMAT = proxy_src_ip::$1
The reason that is not working is because EXTRACT
is evaluated before a REPORT
, i.e the field generated by the latter is not available when the former is called.
Two REPORTS
called in the proper order is the correct course of action here.
A better idea would be to use REPORT for your second extraction as well.
props.conf:
[proxylogs]
REPORT-proxy_fields = proxy_search, proxy_src_ip
transforms.conf:
[proxy_search]
CLEAN_KEYS = false
DELIMS = \t
FIELDS = proxy_sourceip_sourceport, proxy_time, proxy_url, etc
[proxy_src_ip]
SOURCE_KEY = proxy_sourceip_sourceport
REGEX = (.+?):
FORMAT = proxy_src_ip::$1