How to keep only the first 5 lines of a multi-line event?

[garypark]

In my logs I have a lot of java errors that are about 100 lines long. I would like to filter the event at the universal forwarder and keep only the first 5 lines. I would like single line events to be unaffected.

I have the following settings, but they don't seem to be working for me.

In inputs.conf

[monitor:///app/tmp/test-GP/test*]
sourcetype = test-GP
index = test-gp
disabled = 0
whitelist = .log$

In props.conf

[test-GP]
TRANSFORMS-shortenEvents = keepOnly5Lines

In transforms.conf

[keepOnly5Lines]
REGEX = (?m)^(.*\n){1,5}
FORMAT = $1
DEST_KEY = _raw

[somesoni2]

Try this for your transforms.conf (keeping everything else same, your current config just keeps first 5 line in the file and remove all other entries)

[keepOnly5Lines] 
REGEX = (?m)^((.*\n){5})((.*\n)*)
FORMAT = $1
DEST_KEY = _raw