Hi all, I have a forwarder in my cluster and it sends events to the indexers. The events are json formatted and I want to drop some events if a specific key has specific value. For example consider following event: {"process_exec":{"process":{"exec_id":"xXXXXXXXXXx==","pid":1111111,"cwd":"/tmp","binary":"/bin/sleep","arguments":"10"}}} I want to for example if the binary was equal to X, the forwarder drops the event and not send to indexers no index. I created props.conf and transforms.conf. The content of these files are: [json_no_timestamp]
TRANSFORMS-filter = filterLinux and [filterLinux]
REGEX = process.process_exec.binary = '/usr/bin/timeout'
DEST_KEY=queue
FORMAT=nullQueue But the events are not dropped. Any help is appreciated.
... View more