Hello,
I have to drop all events received from hosts named template*
I have created an app on indexer with the following files:
local/app.conf
[install]
is_configured = 1
[ui]
is_visible = 0
label = NoTemplate
[launcher]
author = moi
description = ignore les events qui proviennent des hosts template*
version = 0.0
local/props.conf
[host::template...]
TRANSFORMS-template = drop_templates
local/transforms.conf
[drop_templates]
REGEX = .
DEST_KEY=queue
FORMAT=nullQueue
Events from host template-rh-7t
still indexed !?
I also try with stanza host::template*]
Any idee ?
Thanks
Christian
your pattern in the props stanza name
[host::template...]
matches hostnames 'template' followed by exactly 3 more arbitrary chars.
You should use something like
[host::template.*]
this matches template followed by an arbitrary number of arbitrary chars. Just be careful, this matches anything which starts with template.