How to filter out messages to nullQueue that contain stringA, but keep messages that contain both stringB and stringA?

[Volto]

Hi,

We are filtering messages from our Cisco ASA logs that contain Teardown and Buildup, but we recently wanted to include messages that include SYN Timeout.

The problem with the messages that contain the SYN Timeout also contain Teardown, which are getting filtered out by our transforms.conf file.

My question: Is there a way for us to filter out the messages that contain Teardown, but keep the messages that keep SYN Timeout even though they contain the Teardown string?

[woodcock · Accepted solution]

I do not know the format of your logs but let us suppose it is something like this:

timestamp blah blah SYN Timeout blah blah Teardown blah blah

Then you can use a negative lookahead like this in transforms.conf to throw away ones with SYN Timeout but not Teardown:

[setnull]
REGEX = SYN Timeout(?!.*Teardown)
DEST_KEY = queue
FORMAT = nullQueue

[Volto]

The log format looks like this;

blah blah blah Teardown blah blah blah SYN Timeout

I ended up using a regex like this for matching those that contained Teardown, which we wanted to throw away, but keep that had SYN Timeout, which we wanted to keep.

\s+(Teardown(?!.*SYN\sTimeout))\s+