I'm trying to filter out data after a specific event occurs.
I want to drop all of the search data to display in a timechart, after a this specific event.
The event (and all other data) is in the shape
If the value from name=specific_name changes from 0 to 1 I want to drop all data after this change.
How can I do that?
If you need more information please ask! 🙂
More information plz. Assuming this NOT filtering of events from being ingested but rather doing a search time filter in your search. Please provide details about how your data looks (may be real data), what you're getting now and what you expect.
i think this answer may help, its should be a quick props.conf and transforms.conf setting, we do this to filter out huge debug logs and other things application owners cant adjust on there side.