yet another nullQueue question

[anz_leycurav]

Hi,

I've been trawling through the questions / wiki / docs etc, I just cannot see what I'm doing wrong:

everything is under search/local:

inputs.conf:

[monitor://C:\temp\doneFiles\Router##2304899.log]
disabled = false
followTail = 0
sourcetype = task_log

props.conf:

[task_log]
TRANSFORMS-t1 = otherelim

transforms.conf:

[otherelim]
REGEX = (?si)^.*\bRolled\b.*$
DEST_KEY=queue
FORMAT=nullQueue

I'm trying to filter out multiline events containing "Rolled" on any line. In REGEX101.com I get a match as well as in the inline search. In spite of that I'm still collecting those events:

Router##2304899: Mon Feb 24 12:49:17 EST 2014 - Rolling back ...
Router##2304899: Mon Feb 24 12:49:17 EST 2014 - Rolled back.
Router##2304899: Mon Feb 24 12:49:17 EST 2014 - Getting data ...

I also tried activating debug logs on TailProcessor, used btool to check where my source type was loaded from.. what am I missing??

Thanks vincent.

[yannK · Accepted solution]

It look correct.
Make sure that you deployed the props.conf and transforms.conf on the INDEXERS (and HEAVY FORWARDERS if any).
They have no effect on instances that do not parse the events (universal and lightweight forwarders)

you could change the regex to
REGEX = (?si)\bRolled\b
It's enough to find the lines.

[anz_leycurav]

Thanks Yank, I actually started on a Universal forwarder but can't get it to work on my local full install neither.

Assuming all the log levels were set to DEBUG, where could I expect to see the regex being applied?

thanks again