In my logs I have a lot of java errors that are about 100 lines long. I would like to filter the event at the universal forwarder and keep only the first 5 lines. I would like single line events to be unaffected. I have the following settings, but they don't seem to be working for me. In inputs.conf [monitor:///app/tmp/test-GP/test*] sourcetype = test-GP index = test-gp disabled = 0 whitelist = .log$ In props.conf [test-GP] TRANSFORMS-shortenEvents = keepOnly5Lines In transforms.conf [keepOnly5Lines] REGEX = (?m)^(.*\n){1,5} FORMAT = $1 DEST_KEY = _raw ... View more