forward specified events to reciever

[khanlarloo]

i need only recieve events with action=blocked from farwrders,

my logs are :
Aug 18 12:56:13 192.168.X.X date=2018-08-18 time=12:50:36 devname="XXX" logid="0001000014" type="traffic" subtype="local" level="notice" vd="root" eventtime=1534580436 srcip=192.168.x.x srcname="SPLUNK" srcport=138 srcintf="internal" srcintfrole="lan" dstip=192.168.x.x dstport=138 dstintf=unknown-0 dstintfrole="undefined" sessionid=76899473 proto=17 action="deny" policyid=0 policytype="local-in-policy" service="udp/138" dstcountry="Reserved"

i config my props.conf:

[host::192.168.X.X]
TRANSFORMS-null= setnull,setparsing

and transforms.conf

[setnull]
REGEX = .*
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = (?m)^action=(blocked)
DEST_KEY = queue
FORMAT = indexQueue

but when i do this forwarder doesn't receive any logs from my device,can you tell me where is my mistake?

[jkat54]

Your regex in the setnull is too broad. .* will match everything. Thus sending everything to null queue, and never to indexes.

Your regex in setparsing is interesting.

REGEX = (?m)^action=(blocked)

This would only match events that begin with "action=blocked", but i dont understand why you have a capture group around (blocked).

[khanlarloo]

i have problem when i do this i don't receive any logs from my device in forwarder
where is my mistake? is this configuration right?

[jkat54]

What are you trying to do?

[khanlarloo]

i have one HF and i want to send specific field from my HF to receiver.
the field in my HF is action and i want HF just send field action=block to my receiver.

[jkat54]

Try changing transforms to this

 [setnull]
 REGEX = .*
 DEST_KEY = queue
 FORMAT = nullQueue

 [setparsing]
 REGEX = action\=blocked
 DEST_KEY = queue
 FORMAT = indexQueue

[khanlarloo]

i do this in my HF but it doesn't work.

[jkat54]

In your transforms, try putting nullQueue 2nd

TRANSFORMS-null= setparsing, setnull

Make sure you reload the data to see the effect