i have a huge log file with events, i need to keep around 20-30 events and discard the rest. I have used a stanza in transforms.conf with a REGEX=(MATCH-1 | MATCH-2 | MATCH-3 |..|..|... MATCH-N), such that the events which match with REGEX are in and the rest are sent to nullQueue.
Is there a better way to write instead of writing (MATCH-1 | MATCH-2 | MATCH-3 |..|..|... MATCH-N) in the REGEX?
Please guide..
I'm sure you can optimize your regex to match multiple criteria. Can you provide examples of the events you're trying to filter?
I'm sure you can optimize your regex to match multiple criteria. Can you provide examples of the events you're trying to filter?