Hey @PickleRick  Thanks for the response. Thats how I understand it as well, but it doesnt seem to be working for me. Even if I re-arrange how Im calling the transforms, I am not able to stop id:32605 from appearing in my sourcetype. The below configurations result in  sourcetype = test : all ids are appearing sourcetype = test-2: populated with (id = 32605 & the word successfully ) Even though Im certain I should be filtering out id = 32605. Ive tested the regex and its certainly matching my logs. Are there any tools to see more in-depthly how transforms are working/being applied on the backend? My props now looks like this: [ORIGIN1] REGEX = \"id\":\"32605\".*successfully FORMAT = sourcetype::test-2 DEST_KEY = MetaData:Sourcetype [ORIGIN2] REGEX = successfully.*\"id\":\"32605\" FORMAT = sourcetype::test-2 DEST_KEY = MetaData:Sourcetype [SAVE_OTHERS2] REGEX ="id":"(?!32605\b)\d+" DEST_KEY = queue FORMAT = indexQueue [null] REGEX = \"id\":\"32605\" FORMAT = queue DEST_KEY = nullQueue Transforms: [test] TRANSFORMS-rename_sourcetype = null, ORIGIN1, ORIGIN2, SAVE_OTHERS2 SHOULD_LINEMERGE = false ... View more

Thanks @livehybrid . I've written some new props/transforms to try to get the same result, however now Im running into trouble again.  So my real issue is that there are alot of logs coming in to ID: 32605 that do not have 'successfully' in them that I need to send to the null queue/get rid of. But I dont seem to be able to both get the logs I want to the new sourcetype and get rid of these unwanted ones. Seems no matter the order I put the transforms in below, it does not work. I also tried creating a transform where I specifically target id = 32605 and the log not having the word 'successfully'. That doesnt seem to work either.  Transforms: [ORIGIN1] REGEX = (?:\"id\":\"32605\".*successfully) FORMAT = sourcetype::test-2 DEST_KEY = MetaData:Sourcetype [ORIGIN2] REGEX = (?:successfully.*\"id\":\"32605\") FORMAT = sourcetype::test-2 DEST_KEY = MetaData:Sourcetype [SAVE_OTHERS2] REGEX =(?:"id":"(?!32605\b)\d+") DEST_KEY = queue FORMAT = indexQueue [JUNK] REGEX = (?:"id":"32605") DEST_KEY = queue FORMAT = nullQueue Props: [test] TRANSFORMS-rename_sourcetype = ORIGIN1, ORIGIN2, JUNK, SAVE_OTHERS2 SHOULD_LINEMERGE = false   ... View more