topic Re: Filter data by condition on a heavy forwarder in Getting Data In

Filter data by condition on a heavy forwarder

aalaa — Fri, 30 Aug 2019 11:49:50 GMT

Hello ,

Please i need to filter data on the heavy forwrader to eliminate some logs ,
Exemple : i need to ingnore logs which contains the fields TYPE=PERMIT with the PROTOCOL=HTTP
it's work good to eliminate the log which contains the TYPE=PERMIT but i need to ignore just the TYPE=PERMIT with the PROTOCOL=HTTPS

transforms.conf

[setnull]
REGEX = >PERMIT<
DEST_KEY = queue
FORMAT = nullQueue

Re: Filter data by condition on a heavy forwarder

harsmarvania57 — Fri, 30 Aug 2019 11:59:43 GMT

Can you please post some sample events (Mask sensitive data) ?

Re: Filter data by condition on a heavy forwarder

somesoni2 — Fri, 30 Aug 2019 13:36:32 GMT

Your REGEX should search for both fields, so it necessary to know in which order they appear in your raw data and if your data is multiline. If it's single line and TYPE=PERMIT comes before PROTOCOL=HTTPS, then you could do REGEX = \>PERMIT\<.+\>HTTPS\< but again, more accurate answers can be given if you share some sample data.