I've got a log file I'd like to have the Universal Forwarder watch and index, but there are 34 lines at the beginning of the file from when the service/server restarts that I don't want indexed. I'm trying to use PREAMBLE_REGEX in props.conf on the indexer to have it ignore these lines, but it appears to be ignoring the regex, not the lines. I've verified the syntax of the regex using regex101.com, and it checks out. I've seen other posts where people have used this, so I'm confused as to why it's not working for me. I've even added a # to the beginning of a couple lines and just had ^# in the PREAMBLE_REGEX , but those lines still make it into the indexed data. Maybe I've missed a setting somewhere that turns this on? Any help would be appreciated. I have the PREAMBLE_REGEX in props.conf on the indexer under the corresponding sourcetype, and on the UF, I have queue = parsingQueue in inputs/conf. Jim ... View more