|
I've tried to filter native event logs being indexed using the [WinEventLog...] sourcetype. Here are the config: props.conf [WinEventLog:Security] TRANSFORMS-set = delete transforms.conf [delete] REGEX = .*EventCode\=540.* DEST_KEY = queue FORMAT = nullQueue Wondering if this is a bug?! |
|
Though you don't actually say, I assume your problem is the events with EventCode 540 are not being dropped and that you want them to be. I do not know of any bugs in this area. However, if that is what you are trying to do, one problem is that the " That works great! Yes I do want to drop specific events. How do you another condition in the regex? Say with the EventCode, I also want to include all username "Anonymous Logon"? I'm thinking on the regex "(?m)^EventCode=540.ANONYMOUS LOGON.Logon Type: 3"
(10 Mar '10, 04:38)
BunnyHop
1
You should look at the documents for PCRE: http://perldoc.perl.org/perlre.html
You probably want to use the
(10 Mar '10, 06:35)
gkanapathy ♦
Took awhile but I was able to get my exact regex. I did use the (?msi) prefix. Thanks alot!
(10 Mar '10, 20:41)
BunnyHop
2
I recommend adding a not-a-digit at the end of that regex. For example: "
(28 Aug '10, 00:52)
Lowell ♦
|
