Thanks this is more clear than others' answers. and that I how one should answer instead of playing around the question begging for Karma, Like Drainy 🙂 ... View more

Hello! I did below changes in props and transforms and it works as expected [host::VISHAL-PC] # Instead of host,  we can also use source as well as sourcetype(Syntax [source :: x.log]  [source::sample_sourcetype]) TRANSFORMS-filter = log_level [log_level] REGEX = (INFO|WARN|ERROR) DEST_KEY = queue FORMAT = nullQueue Thanks Suraj ... View more