LI agent log collector remove or exclude text

[TechSTSAnthony]

Hi,

Can someone assist me with a regex entry to exclude certain text from an event entry

In my log file some entries have "*===========* or "*------------* at the beginning , end or on the next line - this is not on every line

Is it possible using regex that when the event is sent to LI it excludes the above text so the event looks clean?

been struggling with this for a couple of days but just can't figure it out

Regards,

Anthony

[daphnissov]

To my knowledge, no, events sent to vRLI are logged as-is. There is no sanitation that can be done in flight. And, by the way, nor can logged events be changed once they've been stored in a bucket. This is because vRLI is designed to be immutable for compliance and regulatory reasons.

[TechSTSAnthony]

daphnissov​ Thank you for the reply

Is it possible using the Regex query to look up and exclude the required text?

I was thinking that putting .*?\* in my regex it would find up to and before the * which is at the start of the text i want to exclude but it would seem LI finds the regex match and takes everything after until the next regex match. is there anyway that LI can take only what matches the regex exactly and not everything after?

Regards,

Anthony