Filter events to nullQueue

ivan123357 — Thu, 21 Mar 2024 12:14:06 GMT

Hi!

I am faced with the following problem. I need to filter the logs that I receive from the source. I get the logs via Heavy-Forwarder, using the following config:

inputs.conf

[udp://4514] index=mylogs sourcetype = mylogs:leef

Before writing regex I tried the following configuration:

props.conf

[mylogs:leef] TRANSFORMS-null= setnull_mylogs

transoforms.conf

[setnull_mylogs] REGEX= . DEST_KEY=queue FORMAT=nullQueue

But it is not working, I still receiving all events in indexes. This conf files store in <heavy_folder>/etc/apps/<app_name>/local. May be I need to use another stanza name in props, but I tried [source::udp://4514] and it is not working. Any ideas? My goal than to write a few regex and receive only useful logs from this source. Thank you.

Re: Filter events to nullQueue

isoutamo — Fri, 22 Mar 2024 17:52:24 GMT

Probably you missed :port part from your input? Without : it doesn’t parse that input correctly. You could see e.g. https://community.splunk.com/t5/Getting-Data-In/udp-portnumber-Event-Blacklist-How-do-I-prevent-unwanted-data/m-p/613039

You have typo on transforms.conf name on your examples, but probably it’s correct on your HF? And you have restarted it after modify those configurations?

r. Ismo

topic Filter events to nullQueue in Getting Data In

Filter events to nullQueue

Re: Filter events to nullQueue