Index time extraction

[bhavneeshvohra9]

Hi all,
I have 10 events containing events from events 1,event2,event 3,....event 10.
I need to cobine events2,3,4 and events 7,8 into one event each i.e one event for 2,3,4 and one event for 7,8.
Rest all i dont need to index(send to null queque)
How can we do this on index time.

Please help

[woodcock]

Like this:

SHOULD_LINEMERGE = false
LINE_BREAKER = ((?:^event1RegExHere[\r\n]+)|(?:event5RegExHere[\r\n]+event6RegExHere[\r\n]+)|(?:event9RegExHere[\r\n]+event10RegExHere[\r\n]*$))

[to4kawa]

porps.conf

should_linemerge = false
line_breaker = ([\r\n]+)event5
transforms-null = null

transforms.conf

[null]
REGEX = [event1|event5|event6|event9|event10]
DEST_KEY = queue
FORMAT = nullQueue