Try one at a time - then try and expand it, also I notice you have spaces in your regex?
If you need 2 then do something like this:
props.conf:
TRANSFORMS-set = setnullevents1,setnullevents2
and then transforms.conf:
[setnullevents1]
blah
[setnullevents2]
blah
From our working one to filter out specific hosts and events:
[setnullevents]
REGEX = (?ms)(EventCode=(17503|6105|6107|6106|6201)\D).*(ComputerName=(COMP-001|COMP-002|COMP-003))
DEST_KEY = queue
FORMAT = nullQueue
... View more