You need to write props.conf and transforms.conf when you want to filter any data.
In your case you need construct your props.conf like below.
[sourcetype]
TRANSFORMS-set =setnull, Error
transforms.conf
[setnull] --------------------------------------this is direct all the unwanted data to null queue. (Same as dev/null for linux)
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[Error] ---------------------- It will filter all the events which have ERROR keyword in them and redirect them to your index
REGEX = ERROR
DEST_KEY = queue
FORMAT = indexQueue
