Filter Virtual Logs at the Agent

In some scenarios, you may want to filter or drop raw logs at the Agent so they are not sent to the Data Processor, reducing bandwidth and resource consumption on the Data Processor. Potential benefits of filtering logs at the Agent include:

• Saves network bandwidth
• Reduces the messages per second (MPS) of the deployment
• Reduces the number of Data Processors needed

Agent prerequisites for filtering virtual logs:

• 7.3.x or higher
• Windows or Linux

When logs are filtered at the Agent, they cannot be recovered.

1. Create a new virtual log source and enable the Drop Logs option. For more information, see Create Virtual Log Sources.
2. Associate one or more virtual log sources with an existing log source virtualization template. For more information, see Modify Log Source Virtualization Templates.
3. Enable virtualization on a new or existing Log Source.
4. Open the properties of a new or existing Log Message Source.
5. Click the Log Source Virtualization tab.
6. Select the Enable Virtualization check box.
7. Click Create Virtual Log Sources.
8. Select the appropriate template under Log Source Virtualization Template.
9. Select the Action check box for the virtual log sources to be included, and then save your changes.