Drop some json fields according to their values

[sigma]

Hi all,

I have a forwarder in my cluster and it sends events to the indexers. The events are json formatted and I want to drop some events if a specific key has specific value. For example consider following event:

{"process_exec":{"process":{"exec_id":"xXXXXXXXXXx==","pid":1111111,"cwd":"/tmp","binary":"/bin/sleep","arguments":"10"}}}

I want to for example if the binary was equal to X, the forwarder drops the event and not send to indexers no index.

I created props.conf and transforms.conf. The content of these files are:

[json_no_timestamp]
TRANSFORMS-filter = filterLinux

and

[filterLinux]
REGEX = process.process_exec.binary = '/usr/bin/timeout'
DEST_KEY=queue
FORMAT=nullQueue

But the events are not dropped.

Any help is appreciated.

[yuanliu]

Unfortunately Splunk cannot process JSON at that level.  Also, the value in your REGEX property doesn't make good regex.  How rigid are the format of these events?  If it is rigid enough, you can use something as simple as

REGEX = \"bindary\":\"/usr/bin/timeout\"

If you have multiple subnodes with key name "binary" and value run-in, you can build better regex based on these possibilities, all provided that format is very rigid.

Granted, JSON format can change without altering semantics.  So, this is not going to be very robust.