Path of props.conf and transforms.conf

[prajnasaha]

I'd like to monitor log files and ingest specific lines from these files. My props.conf and transforms.conf has no error. But for some reason the props.conf is not working and instead of indexing specific lines , it is indexing the whole log. Is there any specific path to place .conf files, or any other solution?

[glc_slash_it]

Hi,

can you paste your confs here? Usually the proper way of doing it would look something like this:

transforms.conf
[filter_some_events]
REGEX = <regex_that_matches_the_events_you_want>
DEST_KEY = _MetaData:Index
FORMAT = <your_index>

props.conf
[<sourcetype_stanza>]
...other_props_configs...
TRANSFORMS-filter_name = filter_some_events

[prajnasaha]

Hi @glc_slash_it , here it is. Although I am not getting the specific lines, instead the whole log is getting indexed.

transforms.conf
[err_line]
REGEX = ^(?!.error)
DEST_KEY = _MetaData:Index
FORMAT = error_idx

props.conf
[err_src]
TRANSFORMS-err_line = err_line