I have been reading through a lot of the previous answers to exclusion, but none match what I need. I need to exclude all INFO and WARN lines from one of my indexes, so that they are never processed. Only the ERROR lines should be processed.
I have this so far, but I'm not certain of a couple of things. One what should I have in the props file to complete it and two, do I need the
in the transforms.conf file:
PROPS.CONF
TRANSFORMS-set = setnull, setparsing
TRANSFORMS.CONF
[setnull]
REGEX = INFO, WARN
DEST_KEY = queue
FORMAT = nullQueue