How to configure transforms.conf and regex to only index lines that do not start with "aa" and send these lines to an index called "AAA"?

[abhayneilam]

Hi,

I have a file which has a data in which many lines are starting with "aa", so I don't want to index all the lines starting with "aa", I only want to index those lines which are not starting with "aa" and also I want these lines to be indexed in a particular index called "AAA". So I want a configuration for this in transforms.conf.

Thanks in advance !!

[somesoni2 · Accepted solution]

Try this in your props.conf

[YourSourcetype]
SEDCMD-removeextra = s/^(\s*)aa.*//
SHOULD_LINEMERGE = false
...other configs you have

This will remove all the lines which are starting with 0 or more spaces followed by aa and will index other lines. You can set your Index=AA in the inputs.conf.

[abhayneilam]

Many thanks it helped me to get the desired result !!

[kml_uvce]

make these changes:

in props.conf
[mysourcetype]
TRANSFORMS-index=sendtomyindex,donotsend


in transforms.conf

[sendtomyindex]
REGEX=.
DEST_KEY=_MetaData:Index
FORMAT=AAA
WRITE_META=true
[donotsend]
REGEX=^[\s\t]+aa.*
DEST_KEY = queue
FORMAT = nullQueue


[abhayneilam]

and moreover in my question it was that .. I want to index all those lines which are not starting with 'aa' I mean a combination of space and tab followed by "aa"

[abhayneilam]

I have just seen that my patter is something like :

    aa yes it is good
    aa he he not bad

So every time before "aa" there is a space or tab I dont know but there is a blank. so it means a line is starting with either space or tab and then followed by 'aa'.

Please help in this !!