I have to drop all events received from hosts named template*
I have created an app on indexer with the following files:
is_configured = 1
is_visible = 0
label = NoTemplate
author = moi
description = ignore les events qui proviennent des hosts template*
version = 0.0
TRANSFORMS-template = drop_templates
REGEX = .
Events from host template-rh-7tstill indexed !?
I also try with stanza host::template*]
Any idee ?
your pattern in the props stanza name
matches hostnames 'template' followed by exactly 3 more arbitrary chars.
You should use something like
this matches template followed by an arbitrary number of arbitrary chars. Just be careful, this matches anything which starts with template.