I've got a heavy forwarder that is filtering out lines from a monitor. and the rest is being send to nullQueu
props.conf
[source1]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
MAX_TIMESTAMP_LOOKAHEAD=35
pulldown_type = 1
TRANSFORMS-set= setnull,setparsing
transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = (?i)event=(event1|event2)
DEST_KEY = queue
FORMAT = indexQueue
in my indexer i did this
props.conf
[source1]
TRANSFORMS-index = splitevent1,splitevent2
EXTRACT-ip = ^(?P<ip>[^,]+)
transforms.conf
[splitevent1]
REGEX = (?i)event1
DEST_KEY = _MetaData:Index
FORMAT = event1index
[splitevent2]
REGEX = (?i)event2
DEST_KEY = _MetaData:Index
FORMAT = event2index
events are still going to the main index. and my defined indexes event1index and event2index are empty.. any ideas???
Have you tried adding the same configs that are on the indexer to the heavy forwarder?
Dave
Have you tried adding the same configs that are on the indexer to the heavy forwarder?
Dave