To my knowledge, no, events sent to vRLI are logged as-is. There is no sanitation that can be done in flight. And, by the way, nor can logged events be changed once they've been stored in a bucket. This is because vRLI is designed to be immutable for compliance and regulatory reasons.
daphnissov Thank you for the reply
Is it possible using the Regex query to look up and exclude the required text?
I was thinking that putting .*?\* in my regex it would find up to and before the * which is at the start of the text i want to exclude but it would seem LI finds the regex match and takes everything after until the next regex match. is there anyway that LI can take only what matches the regex exactly and not everything after?