Hi guys, trying to push all log messages that contain 'Failed' or 'ERROR', but doesn't seem to like my syntax. I have looked at the syntax quite a bit but can't seem to nail it down. Didn't find any examples of "when not" for message.
processors: - add_host_metadata: ~ - add_cloud_metadata: ~ - drop_event: when: not: message: "Failed" or: message: "ERROR"
Thanks in advance