Here is a sample log event I would like to filter:
20180307 11:11:08.795 [process:flow] [INFO] Thread is returning to available thread pool DM.Appl.ThreadPool
Here is current props.conf
Here is current transforms.conf
REGEX = (?i)[INFO]
DEST_KEY = queue
FORMAT = nullQueue
I would like to send all events that contain [INFO] to null queue but the current configurations on the indexer do not seem to be working. Any thoughts on what might be wrong?
square parenthesis is a special char for regexes so you have to escape them, try
REGEX = (?i)\[INFO\]
View solution in original post
Thank you so much. Cant believe it was something so simple.
Hi hI jordanking1992,
if you're satisfied by this answer please accept and/or upvote it.