Hi all,
I have 10 events containing events from events 1,event2,event 3,....event 10.
I need to cobine events2,3,4 and events 7,8 into one event each i.e one event for 2,3,4 and one event for 7,8.
Rest all i dont need to index(send to null queque)
How can we do this on index time.
Please help
Like this:
SHOULD_LINEMERGE = false
LINE_BREAKER = ((?:^event1RegExHere[\r\n]+)|(?:event5RegExHere[\r\n]+event6RegExHere[\r\n]+)|(?:event9RegExHere[\r\n]+event10RegExHere[\r\n]*$))
porps.conf
should_linemerge = false
line_breaker = ([\r\n]+)event5
transforms-null = null
transforms.conf
[null]
REGEX = [event1|event5|event6|event9|event10]
DEST_KEY = queue
FORMAT = nullQueue