Good day experts, to manage the ingestion volume, I need apply truncation to a source that sends pretty high volume of data. However, we do not wish to truncate all events from this source, only certain events which are less critical. I tried to override sourcetype in transforms.conf with a regex that matches less critical events and applying truncate in props.conf to the custom sourcetype but failed. Only then I recalled that the transforms and props apply at indexing time. The transforms worked as expected to change the sourcetype but it did not truncate.  Does anyone faced similar use case or can share a way to manage this? Thank you in advance. ... View more