It is common to have parts of a hostname mean something in particular. If this pattern is well known and predictable, it may be worthwhile to pull the value out into fields. Working from our fictitious host value vlbmba.local (which happens to be my laptop), we might want to create fields for the owner and the host type. Our stanza might look like this:
[host_parts] SOURCE_KEY = MetaData:Host REGEX = (...)(...). FORMAT = host_owner::$1 host_type::$2 WRITE_META = True
With our new fields, we can now easily categorize errors by whatever information is encoded into the hostname. Another approach would be to use a lookup, which has the advantage of being retroactive. This approach has the advantage of faster ...
