This message originated from Cribl Community Slack.
Click here to view the original link.
Separate question. Is there a way to filter for fields at this level instead of inside a pipeline? Ie. we want to have events from "logGroup" X go to a certain route.
Links for this message:
image.png
Solved
Filtering Events By LogGroup Level Instead Of Inside Pipeline Not Supported
Best answer by Jon Rust
This is a great reason to use Pre-proc pipelines. Extract ONCE and EARLY. If you extract things in the pre-pipeline, you can refer to them in the routing table. So much cleaner than trying to regex match, and __inputId match && this &! that
_raw.includes('logGroupName')_raw.match(/someregexto_match/igm)/regexHere/igm.test(_raw)Thanks David. I'm assuming this would be more performant that sending all logGroup(s) in this inputId to a pipeline and dropping all but logGroup=X ? (that's what we currently do)
If it matches it will show the logs. The more specific the better I assume.
This is a great reason to use Pre-proc pipelines. Extract ONCE and EARLY. If you extract things in the pre-pipeline, you can refer to them in the routing table. So much cleaner than trying to regex match, and __inputId match && this &! that
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.