All,
I have a 3 part TRANSFORMS.conf in my props.conf, when enable I receive no logging at all. How ever I am not seeing why.
Log Example -
{"Timestamp":"2019-08-20T23:07:27.8115577+00:00","Level":"FATAL","MessageTemplate":"TEST","Properties":{"MachineName":"something","LogType":"ScheduledTasks","App":"ScheduledTasks","Environment":"13"}
Here is my transforms -
# transforms.conf
# By default collect nothing
[nulldefault]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
# Let go ahead and keep Error|Crit|fatal and others
# Also if the dev mentions "splunk" in their log we'll keep it
[keep]
REGEX=((?i)error|crit|fatal|splunk|ora-|INFO)
DEST_KEY=queue
FORMAT=indexQueue
# even with that there is some common garbage
[final]
REGEX=app_name=SolrCloud
DEST_KEY=queue
FORMAT=nullQueue
Not seeing why this would drop all logs.
↧