the issue is definitely your regex. This part is wrong: 192\.168.\1\.1 \1 doesn’t make sense there unless you previously captured something. You just want to match the literal IP. To drop all events containing 192.168.1.1, your transforms.conf should look like this: [null_1] REGEX = 192\.168\.1\.1 DEST_KEY = queue FORMAT = nullQueue That will drop any event that contains that IP anywhere in the line. If instead you want to drop all traffic with port 123, and assuming the port appears as a full field like in your example: ...,192.168.1.1,192.168.6.225,123,123,... You can match it like this: REGEX = ,123, That makes sure you’re matching the port field and not something random like part of another number. If you want to drop events that contain either that IP or port 123, you can combine them: REGEX = 192\.168\.1\.1|,123, That’s all you need.       ... View more