i have a index which has 3 inputs for security/application/system, since there is a need for application log for another app for same host , i want to exclude it from other one. how can we achieve this.
try this configuration:
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
please add your correct index and hostname in a props stanza