topic Send the logs level info to null queue in Getting Data In

Send the logs level info to null queue

abhi04 — Tue, 12 Dec 2023 15:22:00 GMT

Hi, I am trying to ignore the logs that have level info and want to send them to null queue:

example logs (not including the befor eand after pattern of the logs but its a json format and this is one of the fields):

"level":"info",

I have tried below and it does not work, can someone help if this is correct or is there another way, the below is in heavy forwarder

props:

[abc]
TRANSFORMS-null = infonull

transforms

[infonull]
SOURCE_KEY = level
REGEX = info
DEST_KEY = queue
FORMAT = nullQueue

abhi04 — Tue, 12 Dec 2023 15:29:48 GMT

Sample example logs:

{"timestamp":"2023-12-12T15:27:22.890Z","shortmessage":"(abc): def ghi","level":"info","source":"xyz,"file":"/home/abc/def.txt","line":144}

richgalloway — Tue, 12 Dec 2023 16:17:48 GMT

"level" is not a valid value for SOURCE_KEY. Try _raw, instead.

[infonull] SOURCE_KEY = _raw REGEX = "level":"info" DEST_KEY = queue FORMAT = nullQueue

abhi04 — Tue, 12 Dec 2023 17:25:37 GMT