[ActiveDirectory] TRANSFORMS-null= setnull
[setnull] REGEX = \[ms_Mcs_AdmPwdExpirationTime\] DEST_KEY = queue FORMAT = nullQueue
There likely is an error in the regex, but to know that for sure we'll need to see some example data.
There's the problem. The example data does not match the regex since none of them contain the string "ms_Mcs_AdmPwdExpirationTime". You'll have to find a regular expression that matches all expected strings you wish to send to the null queue.
I was wrong. given string. "ms_Mcs_AdmPwd" there are random symbols of the unit and letters
props.conf
[ActiveDirectory]
TRANSFORMS-null = setnull
transforms.conf
[setnull]
REGEX = ms-Mcs-AdmPwd\s*=(.*)
DEST_KEY = queue
FORMAT = nullQueue
not working
Again, to properly diagnose a regex problem we need to see the events that are to be matched. Not just a tiny snippet, either. Feel free to anonymize sensitive data.
Have you tested your regular expressions on a site like regex101.com?
yes. check in regex101. enable.
tried different regex methods working. now standing which is in the picture above