I am creating some field aliases that I want to apply to multiple sourcetypes. I was hoping to do something like this in props.conf
[mysourcetype_*]
FIELDALIAS-class = fieldname as alias
My thought was this would hopefully apply the alias to the sourcetypes that match that pattern. This didn't appear to work so I resorted to something like this
[source::...*...]
FIELDALIAS-class = fieldname as alias
While this works I have two questions.
Is there a way to specify a pattern for the sourcetype like I was trying to do in the first example?
What are the performance implications, if any, of the second example, which applies the field alias to all sources?
Thanks
There is. You can use:
[(?:::){0}mysourcetype_*]
as the sourcetype stanza header.
Your pattern to match all data could be simpler with any of:
[host::...]
[source::...]
But you can also use:
[(?:::){0}...]
Performance implications are pretty minimal for this.
Where is that documented? I have many sourcetypes starting with a pattern sm_* could I set
[(^:::){0}sm_*]
fieldalias-myfirst = myFirst AS myLast
...
To apply the fieldalias to all the sourcetypes starting with sm_ ?
There is. You can use:
[(?:::){0}mysourcetype_*]
as the sourcetype stanza header.
Your pattern to match all data could be simpler with any of:
[host::...]
[source::...]
But you can also use:
[(?:::){0}...]
Performance implications are pretty minimal for this.