How to drop event comming from host template*

[ktn01]

Hello,
I have to drop all events received from hosts named template*

I have created an app on indexer with the following files:

local/app.conf

[install]
is_configured = 1

[ui]
is_visible = 0
label = NoTemplate

[launcher]
author = moi
description = ignore les events qui proviennent des hosts template*
version = 0.0

local/props.conf

[host::template...]
TRANSFORMS-template = drop_templates

local/transforms.conf

[drop_templates]
REGEX = .
DEST_KEY=queue
FORMAT=nullQueue

Events from host template-rh-7tstill indexed !?

I also try with stanza host::template*]

Any idee ?

Thanks
Christian

[FritzWittwer_ol]

your pattern in the props stanza name
[host::template...]
matches hostnames 'template' followed by exactly 3 more arbitrary chars.

You should use something like
[host::template.*]
this matches template followed by an arbitrary number of arbitrary chars. Just be careful, this matches anything which starts with template.