I have been reading through a lot of the previous answers to exclusion, but non matched what I need. I need to exclude all INFO and WARN lines from one of my indexes so that they are never processed. Only the ERROR lines should be processed. I have this so far, but I'm not certain of a couple of things. One what should I have in the props file to complete it and two, do I need the
in the transforms.conf file:
PROPS.CONF
TRANSFORMS-set = setnull, setparsing
TRANSFORMS.CONF
[setnull]
REGEX = INFO, WARN
DEST_KEY = queue
FORMAT = nullQueue