I'm trying to discard entries from one of my data sources and it isn't working. Why?
All the following are set on the indexer, not the universal forwarder. I've triple checked my work.
inputs.conf
[WinNetMon://inbound]
direction = inbound;outbound
disabled = 0
index = windows
packetType = accept;connect
props.conf
[WinNetMon://inbound]
TRANSFORMS-null1 = null1
transforms.conf
[null1]
SOURCE_KEY = LocalAddress
REGEX = ::1
DEST_KEY = queue
FORMAT = nullQueue
The events I'm getting are source=inbound
and sourcetype=WinNetMon
Your stanza header spec in props.conf
is wrong. You have this:
[WinNetMon://inbound]
You need something like this:
[MySourcetypeHere]
Or
[host::MyHostHere]
Or
[source::MySourceHere]
There are a few other uncommon specs
, but I have never seen them used.
I am quite certain that your sourcetype
is NOT WinNetMon://inbound
and if it is, you should change it. You should have a line like this in your inputs.conf
stanza
sourcetype = MySourcetypeHere
That regex will match any record that has a field called LocalAddress that contains the literal value "::1".
1) Verify the spelling and capitalization of the field.
2) Look at the events themselves and verify whether that is the internal representation in that field.