What is the correct syntax of applying NOT operator in transforms.conf?

[pavanae]

The following is the regex I am working on and what I'm trying to do is exclude any username events that ends with "ZLX" but I doubt that If I am following the right syntax. especially I am not sure if I can use "!" for excluding.

REGEX = (logtype::A.*(id::(123|456)|(id::789.*username!::[a-zA-Z]{2,3}-+.*?-ZLX))

[rahulbhatia]

"(?(<)! sub expression)" regex for negative look behind (remove the bracket before and after less then sign)

"(?! sub expression)" regex for negative look ahead

this might help you to update your regex accordingly

[jawaharas]

Can you post sample log events?