topic how to exclude particular host for a input in Getting Data In

how to exclude particular host for a input

moin140586 — Thu, 29 Apr 2021 05:44:08 GMT

i have a index which has 3 inputs for security/application/system, since there is a need for application log for another app for same host , i want to exclude it from other one. how can we achieve this.

Re: how to exclude particular host for a input

aasabatini — Thu, 29 Apr 2021 07:06:46 GMT

Hi @moin140586

try this configuration:

props.conf

[host::<hostname>] index=<your index> TRANSFORMS-set= setnull

Transforms.conf

[setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue

please add your correct index and hostname in a props stanza