Hello, actually we don't have heavy forwarder instance.
Is it possible filter events in indexer when recieve data from UF's? How much performance affect?
Example to drop events that do not contain $LOG$:
prop.conf
[source_event]
TRUNCATE = 15000
TRANSFORMS-filter = event_drop,event_take
transforms.conf
[event_drop]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[event_take]
REGEX = \$\$LOGS\$\$
DEST_KEY = queue
FORMAT = indexQueue
Hope it help
Christian
Thanks for your answer. My other question is how much performance affect if filter events directly on indexer?