How to exlude the event from Indexing?

[kiran331]

Hi

I have a cisco ASA event , which I have to exclude before Indexing. What's the best way to do it?

sample event:
Jun 26 15:17:23 11.12.13.144 %ASA-6-305012: Teardown dynamic TCP translation from inside:1.2.3.455/33314 to outside:22.33.44.553/33314 duration 0:00:00

I can Exclude the event containing :

ASA-6-305012 1.2.3.455 22.33.44.553 together.

[lguinn2 · Accepted solution]

Yes, you can use a transform to filter the event. Be sure to test before putting the transform in production, otherwise it may filter too many (or too few) of the events! Assuming that the sourcetype is cisco:ASA, then

props.conf

[cisco:ASA]
transforms-cfilter=filter_cisco_asa

transforms.conf

[filter_cisco_asa]
SOURCE_KEY=_raw
REGEX=ASA-6-305012.*?1.2.3.455.*?22.33.44.553
DEST_KEY=queue
FORMAT=nullQueue

The regular expression looks for events that have ASA-6-305012 followed by 1.2.3.455 and then by 22.33.44.553. Any number of characters can come before, after or between these 3 strings, but all of them must be present to match. Any event that matches is discarded (sent to the null queue).