Regex in Filter Expresion

Jari Weststrate

Hi,

Excuse me for my "not knowing", maybe a easy answer for all of you.

I am in the process of migrating our Heavy Forwaders to Cribl . One off the inputs is for Cisco IOS devices. The props.conf has a Regex in it to change the sourcetype with help of a transforms. The props uses a regex to select the events.

Where and how do i put the regex which is used in the props.conf for filtering the events. Do i have to place this regex in the "filter expresion" in the route? Or in a pre-pipeline? And how do i do it?

Thanks in advance

greetings

Jari

Geert van der Giessen

hi Jari,

Most likely you can solve it with the eval function in a pipeline like this:

Of course there are other options as well, so please give me a call if you need more help.

Cheers, Geert.

Jari Weststrate

Thanks Geert, have now put it in a pre-pipeline. Looks good.

greetings

Jari