Have a nice day, everyone! I came across some unexpected behavior while trying to move some unwanted events to the nullQueue. I have the sourcetype named 'exch_file_trans-front-recv'. Events relat...
See more...
Have a nice day, everyone! I came across some unexpected behavior while trying to move some unwanted events to the nullQueue. I have the sourcetype named 'exch_file_trans-front-recv'. Events related to this sourcetype are ingested by a universal forwarder with the settings below: props.conf [exch_file_trans-front-recv]
ANNOTATE_PUNCT = false
FIELD_HEADER_REGEX = ^#Fields:\s+(.*)
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = csv
TIMESTAMP_FIELDS = date_time
BREAK_ONLY_BEFORE_DATE = true
MAX_TIMESTAMP_LOOKAHEAD = 24
initCrcLength = 256
TRANSFORMS-no_column_headers = no_column_headers transforms.conf [no_column_headers]
REGEX = ^#.*
DEST_KEY = queue
FORMAT = nullQueue In this sourcetype I have some events that I want to delete before indexing. You can see an example below: 2024-08-22T12:58:31.274Z,Sever01\Domain Infrastructure Sever01,08DCC212EB386972,6,172.25.57.26:25,172.21.255.8:29635,-,,Local So, I'm interested in deleting events with the pattern '...172.21.225.8:....,'. To do it, I created some settings on the indexer cluster layer: props.conf [exch_file_trans-front-recv]
TRANSFORMS-remove_trash = exch_file_trans-front-recv_rt0 transforms.conf [exch_file_trans-front-recv_rt0]
REGEX = ^.*?,.*?,.*?,.*?,.*?,172.21.255.8:\d+,
DEST_KEY = queue
FORMAT = nullQueue After applying this configuration across the indexer cluster, I still observe new events with the presented pattern. What am I doing wrong?