How do I ignore few keyword contained events at forwarder not to send?

[sathiyasun]

I want to ignore few keyword contained events at forwarder level NOT at indexer.
 Below are the sample log: to Ignore if it finds "INFO OR WARN" messages in log file.
what it would be the file name & config  in UF to tell UF to ignore those events.

Please let me know the settings in UF level to ignore.

Ignore Contained "INFO/WARN"

2023-05-10 14:32:44,843 org:usbank-prod env:usb-prod PKI:YYY-system-Onull-v01 rev:2999 messageid:37166-20 policy:OAuthV2.VerifyKey giopudded-Main-0 INFO STEPDEFINITIONS

2023-05-10 14:32:44,843 org:usbank-prod env:usb-prod PKI:YYY-system-Onull-v01 rev:2999 messageid:37166-20 policy:OAuthV2.VerifyKey giopudded-Main-0 WARN STEPDEFINITIONS

Index only Error:-

2023-05-10 14:32:44,843 org:usbank-prod env:usb-prod PKI:YYY-system-Onull-v01 rev:2999 messageid:37166-20 policy:OAuthV2.VerifyKey giopudded-Main-0 ERROR STEPDEFINITIONS

[glc_slash_it]

Hi,

it will require a combination of props.conf and transforms.conf configs. Try these on a HF and restart it.

transforms.conf
[all_logs]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

[info_warn_discard]
REGEX = (INFO|WARN)
DEST_KEY = queue
FORMAT = nullQueue

props.conf
TRANSFORMS-routing = info_warn_discard, all_logs

[richgalloway]

UFs do not have the ability to filter data.  That requires a Heavy Forwarder (HF) and is done the same way as on an indexer.