Rename source types

Rename source types

You might want to rename a source type in certain situations. For example, say you accidentally assigned an input to the wrong source type. Or you realize that two differently named source types should be handled exactly the same at search time.

You can use the rename attribute in props.conf to assign events to a new source type at search time. In case you ever need to search on it, the original source type is moved to a separate field, _sourcetype.

Note: The indexed events still contain the original source type name. The renaming occurs only a search time.

To rename the source type, add the following to your source type stanza:

rename = <string>

For example, say you're using the source type "cheese_shop" for your application server. Then, accidentally, you index a pile of data as source type "whoops". You can rename "whoops" to "cheese_shop" with this props.conf stanza:

[whoops]
rename=cheese_shop

Now, a search on "cheese_shop" will bring up all the "whoops" events as well as any events that had a "cheese_shop" source type from the start:

sourcetype=cheese_shop

If you ever need to single out the "whoops" events, you can use _sourcetype in your search:

_sourcetype=whoops

Important: Data from a renamed source type will only use the search-time configuration for the target source type ("cheese_shop" in this example). Any field extractions for the original source type ("whoops" in the example) will be ignored.

• Was this topic useful?
• Post a comment