We are trying to index only events that contain a certain structure set by a regular expression: \ S + \ s \ S + \ s \ ((\ S + | \ w + | ./ \ w +) ) : \ s (DATE | END | Running). However, when we assign the indexQueue property in transforms.conf, it doesn't work: [takedata] REGEX = \ S + \ s \ S + \ s \ ((\ S + | \ w + | ./ \ w +) \) \: \ s (DATE | END | Running) DEST_KEY = queue FORMAT = indexQueue If we do it with the nullQueue, we exclude the rows that correspond to that expression. [excludedata] REGEX = \ S + \ s \ S + \ s \ ((\ S + | \ w + | ./ \ w +) \) \: \ s (DATE | END | Running) DEST_KEY = queue FORMAT = nullQueue Can any help us? Thanks. ... View more