How to blacklist keywords in inputs.conf

[alexspunkshell]

Hi,

I am using UF for syslog. In inputs.conf made index=cisco and sourcetype=syslog:ios and able to receive logs in console.

Now i am receiving too much logs. Having below keywords in logs.

"DOMAIN-2-IME"

"DOMAIN-2-IME_DETAILS"

"DOMAIN-5-TCA"

tried blacklist = "Domain" in inputs.conf but failed to filter it. Plese help me how to filter logs with Keywords in logs.

[richgalloway]

Blacklisting is for filenames to monitor, not keywords within events. To strip out events based on text within those events, check out SEDCMD in props.conf. It uses regular expressions to modify events before they're indexed. WARNING: your regex must identify the whole event if that is what you want to change. The UF will not do that for you.
You may want to check if your syslog server can do the filtering for you. That may be easier.