Regex

[uagraw01]

I want to exclude this event "values='{CARD}hfgjllanabbflvh=='} from the server. Please suggest me regex for this and suggest me the props and transforms for this.

Below the sample event:

' weblogic.server values='{CARD}hfgjllanabbflvh=='}

[Sourcetype]
SHOULD_LINEMERGE = false
TRANSFORMS-mask = one

[one]
REGEX =
FORMAT = 
DEST_KEY = 

[scelikok]

Hi @uagraw01 ,

I think you want to filter all event that contains values='{CARD}hfgjllanabbflvh=='}  string. Please try below; 

transforms.conf

[one]
REGEX = values\='{CARD}hfgjllanabbflvh=='}
DEST_KEY = queue
FORMAT = nullQueue

If this reply helps you an upvote is appreciated.