Hello.
Appreciate your support, in the file transforms.conf REGEX try to make a log of all without "webfilter" and sent to nullQueue.
I tried to do something like this
[discard]
REGEX=!webfilter
DEST_KEY=queue
FORMAT=nullQueue
but it was not, then I tried:
[discard]
REGEX=.
DEST_KEY=queue
FORMAT=nullQueue
[maintain]
REGEX=webfilter
DEST_KEY=queue
FORMAT=indexQueue
But neither worked.
what would be the correct syntax for this case?
Thanks in advance
Try this. I'm only guessing at the regex because you have not posted an example of your event.
In Props.conf
[host::10.10.0.5]
TRANSFORMS-FORTIGATE=discard,maintain
In Transforms.conf
[discard]
REGEX=.
DEST_KEY=queue
FORMAT=nullQueue
[maintain]
REGEX=webfilter
DEST_KEY=queue
FORMAT=indexQueue
Then you should add an extra stanza in transforms.conf;
[null_dns_ssl]
REGEX = app=\"(DNS|SSL)\"
DEST_KEY = queue
FORMAT = nullQueue
And call it from props.conf like this (order is important)
TRANSFORMS-FORTIGATE = discard, maintain, null_dns_ssl
/K
Ah ok, if so that's fine, so far I agree with Splunk.
Rather, now that I'm reviewing the result of the filter we did, there are some log that I would not be lost, and are those that do not contain the following: app="DNS" or app="SSL"
I tried to do like this: REGEX=webfilter|app=(?!"DNS|SSL]")
But it is showing me logs with app="DNS" or app="SSL"
I could be wrong?
The solution I posted is the documented solution. How about we get it working first, and then optimize.
Hello, thanks. The detail was separated with, aliases: TRANSFORMS-FORTIGATE = discard, Maintain
But tell me, the double REGEX would not do it with less optimal one, and the idea of lguinn? Maybe save some resources, right?
I think that the problem was the regular expression. This one is more complicated, but I think it will actually work. The other one was wrong.
In transforms.conf
[discard]
REGEX=(?i)(?!.*?webfilter)
DEST_KEY=queue
FORMAT=nullQueue
In props.conf
[host::10.10.0.5]
TRANSFORMS-FORTIGATE_discard=discard
Note that in your comment, you have two transforms that start with TRANSFORMS-FORTIGATE
and these should be unique. For example TRANSFORMS-FORTIGATE1
and TRANSFORMS-FORTIGATE2
. I renamed my stanza above to make sure it was unique.
Hi, thanks for your reply, I find interesting the syntax, but here now this filters all log me, and does not pass any 😞
Hello, you will know what can be the problem?
Hi, I have the following:
[host::10.10.0.5]
TRANSFORMS-FORTIGATE=discard
TRANSFORMS-FORTIGATE=maintain
I just want to keep the log that have "Webfilter"
What do you have in the corresponding props.conf?
Also, an example of the event that contains "webfilter" would be handy.