extracting from logs before indexing to server

[dhs_harry08]

Hi

Is there a way to extract a part of log event before it being indexed to splunk server for example
Below is the entire event.

====================
{ActiveMQ Session Task} DEBUG LogCollector - start[1311770824360] time[474] tag[card;cardCreation;cardCreation End] host[hagrid.hyd.wc;127.0.0.1]
{ActiveMQ Session Task} DEBUG PerfLoggerDAOImpl - getting ServiceOperationInfo
Hibernate: select serviceope1_.id as id2_, serviceope1_.service_id as service2_2_, serviceope1_.operation_name as operation3_2_, serviceope1_.operation_descr as operation4_2_, serviceope1_.status as status2_ from service_info serviceinf0_, service_operation_info serviceope1_ where serviceope1_.service_id=serviceinf0_.id and serviceinf0_.name=? and serviceope1_.operation_name=?
Hibernate: select serviceinf0_.id as id1_0_, serviceinf0_.name as name1_0_, serviceinf0_.description as descript3_1_0_, serviceinf0_.type as type1_0_, serviceinf0_.status as status1_0_ from service_info serviceinf0_ where serviceinf0_.id=?
{ActiveMQ Session Task} DEBUG PerfLoggerDAOImpl - saving TaskExecutionInfo instance
=============

But I want only to see this "start[1311770824360] time[474] host[hagrid.hyd.wc;127.0.0.1]" in my indexer and the rest of part should be ignored. the filtering to be done on the client side only.
Is this possible.
Regards,
Harish

[dhs_harry08]

I am actually using splunk forwarder. Is it possible to specify in splunk forwarding config files or write some script to filter out the my application logs.

Regards,
Harish

[Damien_Dallimor]

I'm going to presume that your source application is using log4j as its logging framework(because activemq uses log4j) , therefore you could declare a seperate log4j appender in your log4j config file that outputs only the log data you want to send to the Splunk Indexer.