Keeping only some events and discarding the rest requires two transforms. In this scenario, which is opposite of the previous, thesetnulltransform routes all events tonullQueuewhile thesetparsingtransform selects the sshd events and sends them on toindexQueue.
As with other index-time field extractions, processing of transforms happens in the order that you specify them, from left to right. The key difference is the order in which you specify the stanzas. In this example, thesetnullstanza must appear first in the list. This is because if you set it last, it matches all events and sends them to thenullQueue, and as it is the last transform, it effectively throws all of the events away, even those that previously matched thesetparsingstanza.
When you set thesetnulltransform first, it matches all events and tags them to be sent to thenullQueue. Thesetparsingtransform then follows, and tags events that match[sshd]to go to theindexQueue. The result is that the events that contain[sshd]get passed on, while all other events get dropped.