topic Path of props.conf and transforms.conf in Getting Data In

Path of props.conf and transforms.conf

prajnasaha — Fri, 14 Jun 2024 06:23:41 GMT

I'd like to monitor log files and ingest specific lines from these files. My props.conf and transforms.conf has no error. But for some reason the props.conf is not working and instead of indexing specific lines , it is indexing the whole log. Is there any specific path to place .conf files, or any other solution?

Re: Path of props.conf and transforms.conf

glc_slash_it — Fri, 14 Jun 2024 07:20:55 GMT

Hi,

can you paste your confs here? Usually the proper way of doing it would look something like this:

transforms.conf [filter_some_events] REGEX = <regex_that_matches_the_events_you_want> DEST_KEY = _MetaData:Index FORMAT = <your_index> props.conf [<sourcetype_stanza>] ...other_props_configs... TRANSFORMS-filter_name = filter_some_events

Re: Path of props.conf and transforms.conf

prajnasaha — Wed, 19 Jun 2024 14:49:36 GMT

Hi @glc_slash_it , here it is. Although I am not getting the specific lines, instead the whole log is getting indexed.

transforms.conf [err_line] REGEX = ^(?!.error) DEST_KEY = _MetaData:Index FORMAT = error_idx props.conf [err_src] TRANSFORMS-err_line = err_line