title: NXlog Input Filter
body: <p>I wanna drop a certain dnslog line from forwarding to my SIEM server..</p>
  
  <p>the logline i wish to drop is the one with "sophosxl" query..  I try the the nxlog config below but its not working.. </p>
  
  <p>Pls help... Thanks  </p>
  
  <p><strong>My Sample  Logs File:</strong></p>
  
  <pre><code>3/2/2018 6:47:04 PM 0D84 PACKET  000000C1FF664DD0 UDP Rcv 10.5.102.203    4140   Q [0001   D   NOERROR] A      (4)win8(4)ipv6(9)microsoft(3)com(0)
  
  3/2/2018 6:47:04 PM 0D84 PACKET  000000C1FF703080 UDP Rcv 192.164.47.70   1035   Q [0001   D   NOERROR] A      (2)go(9)microsoft(3)com(0)
  
  3/2/2018 6:47:04 PM 0D84 PACKET  000000C1FF7070A0 UDP Rcv 10.51.51.56     a55d   Q [0001   D   NOERROR] A      (1)4(8)sophosxl(3)net(0)
  
  3/2/2018 6:47:04 PM 0D84 PACKET  000000C1FF705090 UDP Rcv 192.164.33.37   a4c1   Q [0001   D   NOERROR] A      (12)filedownload(6)lenovo(3)com(0)
  </code></pre>
  
  <p><strong>NXLOG_CONFIG</strong></p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;Input dns&gt;
      Module  im_file
      File  "C:\dns.log"
   
      SavePos TRUE
   #InputType multilineEmtpyLine
      ReadFromLast TRUE
   Exec if ($raw_event == '') drop();
   Exec if ($message =~ /sophosxl/) drop();
      PollInterval 1
      Exec $Message = $raw_event;
   # $SyslogFacilityValue = 22;
  &lt;/Input&gt;</code></pre>
  </div>
  </div>
  </p>