Cribl 通过字段regex 来过滤filter

cribl 通过regex 来过滤event: 下面实践一把: 

To filter events in real time (data in motion), we can use the out-of-the-box Regex Filter Function. This is similar to nullqueueing with TRANSFORMS in popular SIEMs, but the matching condition is way more flexible.

In this example, we'll filter out any client_port=='2021' events with a _raw field containing the pattern Removed.

important

1. In the Stream UI's top nav, make sure Manage is active.
2. From the submenu, select Proc