Why am I still seeing debug logs in the Splunk heavy forwarder filtering?

[raindrop18]

I have set the following on transforms.conf and props.conf but I still see DEBUG logs in my search. what did I miss

transforms.conf

#Remove: DEBUG
[null_kube_DEBUG]
REGEX = (DEBUG)
DEST_KEY=queue
FORMAT=nullQueue

props.conf

#### kube ################################
[source::kube.var.log.containers.*]
TRANSFORMS-null = null_kube_DEBUG

[p_gurav]

Can you try to use in props.conf:

 [null_kube_DEBUG]
 REGEX = DEBUG
 DEST_KEY=queue
 FORMAT=nullQueue

[raindrop18]

thanks for the response, but still not filtering DEBUG. is there any difference for the logs ingested via http even collector (HEC)? this issue only I got on the logs ingested via HEC, other logs ingested via UF I don't see this issue.

[richgalloway]

Did you restart the HF?

[raindrop18]

yes I did 🙂

[somesoni2]

This will only affect the new incoming messages (any already ingested data would still showup in the search results). What does you DEBUG event look like? Can share a sample or two?

[raindrop18]

2018-04-20 20:36:35 DEBUG NetworkClient:627 - Initiating connection to node -1 at myserver1.net:9092.\n
2018-04-20 20:36:35 DEBUG NetworkClient:767 - Initialize connection to node -1 for sending metadata request\n
2018-04-20 20:36:35 DEBUG NetworkClient:570 - Node -3 disconnected.\n
2018-04-20 20:36:35 DEBUG NetworkClient:627 - Initiating connection to node -1 at myserver1.net:9092.\n
2018-04-20 20:36:35 DEBUG NetworkClient:767 - Initialize connection to node -1 for sending metadata request\n
2018-04-20 20:36:35 DEBUG NetworkClient:570 - Node -2 disconnected.\n

[raindrop18]

this is newly ingested data.