how to exclude particular host for a input

[moin140586]

i have a index which has 3 inputs for security/application/system, since there is a need for application log for another app for same host , i want to exclude it from other one. how can we achieve this.

[aasabatini]

Hi @moin140586 

try this configuration:

props.conf

[host::<hostname>]
index=<your index>
TRANSFORMS-set= setnull

Transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

please add your correct index and hostname in a props stanza