topic Re: Send filtered data to syslog and not index it in Getting Data In

Send filtered data to syslog and not index it

cloud_cloud — Sat, 19 Nov 2011 18:45:25 GMT

How to send filtered system log errors only to syslog and NOT index that data?

My current configuration send to syslog and index data.

props.conf

[nyc]
TRANSFORMS-nyc = send_to_syslog

transforms.conf

[send_to_syslog]
REGEX = error
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group, send_to_null

[send_to_null]
REGEX = .*
DEST_KEY = queue
FORMAT = nullQueue

outputs.conf

[syslog:my_syslog_group]
server=192.168.118.128:514
index=false

Re: Send filtered data to syslog and not index it

Takajian — Mon, 28 Sep 2020 10:10:21 GMT

props.conf
In you case, I assume "nyc" is sourcetype you want to forward to syslog server. So, following configuration will work. Is your target server is syslog, not splunk index server, isn't it.

[nyc]
TRANSFORMS-nyc = send_to_syslog

transforms.conf

[send_to_syslog]
REGEX = error
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

outputs.conf

[syslog:my_syslog_group]
server=192.168.118.128:514

Re: Send filtered data to syslog and not index it

FRoth — Mon, 09 Sep 2013 12:06:26 GMT

This forwards the data as syslog - yes.
But the data still gets indexed.

Re: Send filtered data to syslog and not index it

sowings — Mon, 09 Sep 2013 15:26:02 GMT

You'd need a second transform after (as part of the [nyc] sourcetype) to subsequently null queue the local event, after forwarding a copy to syslog.