Hi guys, trying to push all log messages that contain 'Failed' or 'ERROR', but doesn't seem to like my syntax. I have looked at the syntax quite a bit but can't seem to nail it down. Didn't find any examples of "when not" for message.
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- drop_event:
when:
not:
message: "Failed"
or:
message: "ERROR"
Thanks in advance