The solution would be to apply a regex to extract the environment from the hostname. As a result the we i the props.conf you need to apply this to all host
props.conf
****************************************************************
[host::*]
TRANSFORMS-GLOBAL_environment_from_host = environment_from_host
In the transform.conf we need to specify source key for the regex as MetaData:Host , apply the regex and since this is a new field you have apply WRITE_META = true.
transform.conf
******************************************************************
[environment_from_host]
SOURCE_KEY = MetaData:Host
REGEX = "APPLY YOUR Regex HERE"
FORMAT = env::$1
WRITE_META = true
PLease be sure to apply your correct regex
... View more