I want to ignore few keyword contained events at forwarder level NOT at indexer.
Below are the sample log: to Ignore if it finds "INFO OR WARN" messages in log file.
what it would be the file name & config in UF to tell UF to ignore those events.
Please let me know the settings in UF level to ignore.
Ignore Contained "INFO/WARN"
2023-05-10 14:32:44,843 org:usbank-prod env:usb-prod PKI:YYY-system-Onull-v01 rev:2999 messageid:37166-20 policy:OAuthV2.VerifyKey giopudded-Main-0 INFO STEPDEFINITIONS
2023-05-10 14:32:44,843 org:usbank-prod env:usb-prod PKI:YYY-system-Onull-v01 rev:2999 messageid:37166-20 policy:OAuthV2.VerifyKey giopudded-Main-0 WARN STEPDEFINITIONS
Index only Error:-
2023-05-10 14:32:44,843 org:usbank-prod env:usb-prod PKI:YYY-system-Onull-v01 rev:2999 messageid:37166-20 policy:OAuthV2.VerifyKey giopudded-Main-0 ERROR STEPDEFINITIONS
Hi,
it will require a combination of props.conf and transforms.conf configs. Try these on a HF and restart it.
transforms.conf
[all_logs]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue
[info_warn_discard]
REGEX = (INFO|WARN)
DEST_KEY = queue
FORMAT = nullQueue
props.conf
TRANSFORMS-routing = info_warn_discard, all_logs
UFs do not have the ability to filter data. That requires a Heavy Forwarder (HF) and is done the same way as on an indexer.