Regex for nullQueue, conditional regex. Can someone figure it out?

[adamsmith47]

Hello all,

I'm not sure this is doable with nullQueue in transforms to filter out events of this form, hopefully someone can crack it. For simplicity I will be using mock place holders instead of my actual events and regex.

So, my events may include two unique strings of text, which I'm capable of matching with {MyRegexA} and {MyRegexB}. There are only 3 possible event types which will be read:

1) "blah blah blah" {MyRegexA} "blah blah blah" {MyRegexB} "blah blah blah"
2) "blah blah blah blah blah blah blah blah blah" {MyRegexB} "blah blah blah"
3) "blah blah blah blah blah blah blah blah blah blah blah blah blah blah blah"

Sorry for the crudeness of examples, but the real events are quite large (hundreds of lines), and {MyRegexA} {MyRegexB} are also quite long.

I'm looking for a nullQueue regex which will discard ONLY event type #2, namely, where there is a match for {MyRegexB} but no match for {MyRegexA} prior in the event.

I was thinking a negative lookbehind of the form

(?<!{MyRegexA}){MyRegexB}

would do it, but that actually matches both #1 and #2. At least on my test site, www.regexr.com

Any advice?

[paulstout]

Would it be possible to assign a different sourcetype to events matching MyRegexA and MyRegexB? Example:

Let:

SourcetypeA = the incoming sourcetype
SourcetypeB = the new sourcetype that we do not want to discard

props.conf

[sourcetypeA]
TRANSFORMS-checkAB=checkAB, discardB

transforms.conf

[checkAB]
REGEX = YOUR_A_AND_B_REGEX
DEST_KEY = MetaData:Sourcetype
FORMAT = SourcetypeB

[discardB]
REGEX = YOUR_B_REGEX
DEST_KEY = queue
FORMAT=nullQueue