keep some events and discard the rest

[trkalva]

i have a huge log file with events, i need to keep around 20-30 events and discard the rest. I have used a stanza in transforms.conf with a REGEX=(MATCH-1 | MATCH-2 | MATCH-3 |..|..|... MATCH-N), such that the events which match with REGEX are in and the rest are sent to nullQueue.

Is there a better way to write instead of writing (MATCH-1 | MATCH-2 | MATCH-3 |..|..|... MATCH-N) in the REGEX?

Please guide..

[carmackd · Accepted solution]

I'm sure you can optimize your regex to match multiple criteria. Can you provide examples of the events you're trying to filter?