{[-] EventInfo : {[+]}, EventType : "INFO", Properties : {[+]}, TimeStamp : "2014-01-03T19:31:30.3319998Z" }
How do i discard events that have EventType = INFO?
Currently my transforms and props are:
(transforms)
[treessvcignore]
REGEX = \"EventType\"\:\"INFO\"
DEST_KEY = queue
FORMAT = nullQueue
(props)
[host::TREESSVC*]
TRANSFORMS-null = treessvcignore
This data is in json format
The raw data looks like this
The raw event is
{"EventType":"INFO","TimeStamp":"2014-01-03T06:59:59.9645694Z","Properties":{"StackId":"PER_RNK","applicationClass":"CollatorApplication","name":"PersonRank","type":"Collator","serverClassType":"Live","serverClassApplication":"Multi","ComponentId":"PersonRank","ClientId":"Unknown","ClassName":"CollatorHandlers","MethodName":"Query","ClientPath":"Unknown","RequestPath":"a61a2538-9ef6-4c2c-8579-0d6e073c4159","Metric":...
... View more