I've added the following filter to only capture Windows event types "WARNING" AND "ERROR":
if [type] == "eventlog" and "INFO" in [EventType] {
drop {
}
}
Now, I'd like to exclude some hosts from this filter so that event types "INFO", "WARNING" AND "ERROR" are reported for them. I tried adding a regex, as follows:
if [Hostname !~ /^myhost? and [type] == "eventlog" and "INFO" in [EventType] or "INFO" in [Severity] {
drop {
}
}
This doesn't work. The host "WARNING" and "ERROR" event types are still reported, but not "INFO" types. How do I achieve what I'm trying to?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.