I am trying to filter events on a LightWeightForwarder, but they don't get dropped. Is there a way to debug this?
I have defined the following in an app which I deploy from the indexer.
In props.conf [source::/var/opt/app/logs/navajo.log] TRANSFORMS-set= setnull In transforms.conf [setnull] REGEX=toolbar DEST_KEY=queue FORMAT=nullQueue
The events containing "toolbar" keep coming. Even if I set the regex to "REGEX=." the events still arrive on the indexer.
LWF does not perform the indexing, and therefore, does not do anything with the event but forward it. You should place this on the receiver. Your syntax is correct, just need to move the config to the receiver. Make sure you restart.