Quantcast
Channel: Questions in topic: "props.conf"
Viewing all articles
Browse latest Browse all 1485

Are my props.conf and transforms.conf correct in setting metadata from TCP input?

$
0
0
So... I am attempting to setup a TCP input, which will automatically set metadata, from the event. The _Raw looks like: `{"time":"2017-01-31T15:51:56.9081571-06:00","index":"main","source":"ToolsTesting","host":"348SR52-OGS","Event":"Hello world"}` With the pretty version looking like: { [-] Event: Hello world host: 348SR52-OGS index: main source: ToolsTesting time: 2017-01-31T15:51:56.9081571-06:00 } So, the "Event" field contains the actual event, whether it be hello world, or a complex object, That piece is working.... But, I want to be able to set the source, host, index... etc, via fields located in my raw input. So far, I have this.... Props: [toolsjson] INDEXED_EXTRACTIONS = json KV_MODE = json NO_BINARY_CHECK = true category = Structured description = Parse out messages pulldown_type = 1 disabled = false TRANSFORM-setsource=set_source_value Transforms: [set_source_value] DEST_KEY = MetaData:Host REGEX = . FORMAT = host::$1 I guess the issue is.... I am not very familiar with how to properly use transforms to set the fields. I have looked over a few examples, and I am still slightly lost. Can somebody give me a bit of help? As a bonus, I would like to strip the "metadata" out of my raw event, and only display the actual event.

Viewing all articles
Browse latest Browse all 1485

Latest Images

Trending Articles



Latest Images

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>