Is it possible to create an if/else statement with the TRANSFORMS_ field into props.conf file ?

[Zanusha443]

I have data coming from a single source

but I want to send the events that match a REGEX to an index and all the other that not match it to another index.

I have already tried to change the order of the fields into the TRANSFORMS_ but it still put the events in both indexes.
This is the content of the props.conf file:

[tmpproxy]

TRANSFORMS_routing1 =CIDR_Routing_matched, CIDR_Routing_others

and this is the content of the transforms.conf file:

[CIDR_Routing_matched]
REGEX =src_host\=(?:10\.10\.10\.\d{1,3}|)
FORMAT = tmp_matched_proxy
DEST_KEY=_MetaData:Index
WRITE_META=true

[CIDR_Routing_others]
REGEX =.+
FORMAT = tmp_others_proxy
DEST_KEY=_MetaData:Index
WRITE_META=true

Is it possible to stop the TRANSFORMS_ field in the props.conf file after the first good match?

[gcusello · Accepted solution]

Hi @Zanusha443 ,

you have to set in the inputs.conf the index that doesn't match the regex.

Then on Indexers, or (if present) in Heavy Forwarders, you have to override index value using props.conf and transforms.conf.

in props.conf:

[your_sourcetype]
TRANSFORMS-index = overrideindex

in transforms.conf:

[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = src_host\=(?:10\.10\.10\.\d{1,3}|)
FORMAT = my_new_index

supponing that src_host\=(?:10\.10\.10\.\d{1,3}|) is the regex for events to be sent to the other index.

Beware to the location of these files: if you have one or more intermediate Heavy Forwarders, you have to put them on the first HF, if there isn't any HF, you have to put them on Indexers.

Ciao.

Giuseppe