Sometimes, it can be useful to dynamically create fields from an event. For instance, say we have an event, such as:
2012-08-25T20:18:09 action=send from_335353("a@b.com") to_223523("c@d.com") cc_39393("e@f.com") cc_39394("g@h.com")
It would be nice to pull from, to, and cc as fields, but we may not know all of the possible field names. This stanza in transforms.conf would create the fields we want, dynamically:
[dynamic_address_fields]
REGEX=s(S+)_S+("(.*?)")
FORMAT = $1::$2
MV_ADD=true
While we're at it, let's put the numeric value after the field name into a value:
[dynamic_address_ids]
REGEX=s(S+)_(S+)("
FORMAT = $1::$2
MV_ADD=true
This gives us multivalue fields such as the ones in the following screenshot:
One thing that we cannot do is add extra text to the FORMAT attribute. For instance, in the second case, it would be nice to use a FORMAT attribute such as this one:
FORMAT = $1_id::$2
Unfortunately, this will not function as we hope and will instead create the field id.