i have a index which has 3 inputs for security/application/system, since there is a need for application log for another app for same host , i want to exclude it from other one. how can we achieve this.
Hi @moin140586
try this configuration:
props.conf
[host::<hostname>]
index=<your index>
TRANSFORMS-set= setnull
Transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
please add your correct index and hostname in a props stanza