Sorry, I didn’t quite get your point. Let me clarify. For example, if this is my data:  <Interceptor> <AttackCoords>-423423445345345.10742916222947</AttackCoords> <Outcome>2</Outcome> <Infiltrators>20</Infiltrators> <Enforcer>2</Enforcer> <ActionDate>2-04-24</ActionDate> <ActionTime>00:2:00</ActionTime> <RecordNotes>test</RecordNotes> <NumEscaped>0</NumEscaped> <LaunchCoords>-222222</LaunchCoords> <AttackVessel>111</AttackVessel> </Interceptor>   I want to extract only ActionDate and RecordNotes and ignore all other fields during ingestion. This way, the data will be cleared of unnecessary fields. In transforms.conf, I aim to create a regex pattern for ActionDate and RecordNotes to filter out other fields, making the resulting data look like this: <Interceptor> <ActionDate>2-04-24</ActionDate> <RecordNotes>test</RecordNotes> </Interceptor> How can I achieve this? ... View more

Okay, got it. One last thing: is there any regex to check if any field not in the extracted list can be ignored from indexing? ... View more

  Hello Giuseppe, In my case, the goal is to ensure that the data is cleaned before indexing. For instance, if the data is: <test>dasdada</test><test2>asdasda</test2> I only need the data for the <test> field, and I don’t want the <test2> field to appear. Additionally, there are many fields that I don’t require, so creating a regex for each unwanted field to remove it with SEDCMD or a blacklist would be challenging. Is there a way to delete fields that aren’t extracted from the log before indexing?         ... View more

there is no solution in this link, it's only a question  ... View more

Hi Ryan,  The Error that I have is  "events-service-api-store / Connection to ElasticSearch: clusterName=[appdynamics-events-service-cluster]" : { "healthy" : false, "message" : "None of the configured nodes are available: [{#transport#-1}{10.13.2.33}{10.13.2.33:9300}, {#transport#-2}{10.13.2.36}{10.13.2.36:9300}, {#transport#-3}{10.13.2.37}{10.13.2.37:9300}]", "error" : { "message" : "None of the configured nodes are available: [{#transport#-1}{10.13.2.33}{10.13.2.33:9300}, {#transport#-2}{10.13.2.36}{10.13.2.36:9300}, {#transport#-3}{10.13.2.37}{10.13.2.37:9300}]", "stack" : [ "org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(TransportClientNodesService.java:290)", "org.elasticsearch.client.transport.TransportClientNodesService.execute(TransportClientNodesService.java:207)", "org.elasticsearch.client.transport.support.TransportProxyClient.execute(TransportProxyClient.java:55)", "org.elasticsearch.client.transport.TransportClient.doExecute(TransportClient.java:288)", "org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:359)", "org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:348)", "org.elasticsearch.client.support.AbstractClient$ClusterAdmin.execute(AbstractClient.java:848)", "org.elasticsearch.client.support.AbstractClient$ClusterAdmin.nodesStats(AbstractClient.java:943)", "com.appdynamics.analytics.processor.elasticsearch.node.admin.ElasticSearchAdminFacade.getNodesStatsResponse(ElasticSearchAdminFacade.java:410)", "com.appdynamics.analytics.processor.elasticsearch.node.provider.ElasticSearchClientFacade.getNodesStatsResponse(ElasticSearchClientFacade.java:368)", "com.appdynamics.analytics.processor.elasticsearch.clusters.ClusterHealthStateReporter.isPartOfCluster(ClusterHealthStateReporter.java:120)", "com.appdynamics.analytics.processor.elasticsearch.clusters.ClusterHealthStateReporter.updateHistogram(ClusterHealthStateReporter.java:110)", "com.appdynamics.analytics.processor.elasticsearch.clusters.ClusterHealthStateReporter.updateHealthCheckResult(ClusterHealthStateReporter.java:99)", "com.appdynamics.common.util.health.AsynchronousHealthCheckable.runUpdateHealthCheckResult(AsynchronousHealthCheckable.java:122)", "com.appdynamics.common.util.health.AsynchronousHealthCheckable.access$100(AsynchronousHealthCheckable.java:46)", "com.appdynamics.common.util.health.AsynchronousHealthCheckable$2.run(AsynchronousHealthCheckable.java:146)", "java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)", "java.util.concurrent.FutureTask.runAndReset(Unknown Source)", "java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(Unknown Source)", "java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source)", "java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)", "java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)", "java.lang.Thread.run(Unknown Source)" ] }  ... View more