Each destination can be configured to forward only particular events. The default behaviour for each destination depends on the first filter.
...
If the first filter is set to EXCLUDE, then all events will be sent to the destination, except for those that are specifically excluded by the subsequent filters.
Some examples Examples of matches are listed below:
| Info | ||
|---|---|---|
| ||
Snare agents transmit the hostname as the first element of the event, followed by a tab. Some options to capture 'myhostname' are shown below. Which option you use, will depend on the format your log source uses to send through events. ^myhostname\t ^myhostname(\.mydomain)\t ^([Mm]y[Hh]ostname|MYHOSTNAME) |
| Info | ||
|---|---|---|
| ||
How specific your regular expression matches are will depend on your requirements. ^<[0-9]+> |
| Info | ||
|---|---|---|
| ||
Search for a 'whitespace' character, followed by the text 'myword' followed by another whitespace character, or an end-of-line marker.
|
...
| Info | ||
|---|---|---|
| ||
It is important to note that any matches are performed on the string in the format in which it arrives at the Reflector and not on the format that it will be translated to when sent to the remote destination. All matches are case sensitive and use PCRE based regular expression formats. |
...