This can be done by defining a regex to match the necessary event and sending everything else to the null queue. Here is a basic example.  The example that will drop everything except events that contain the string login   In props. conf:  [source::/var/log/foo]  # We must apply Transforms in this order  # to make we dropped sure events on the  # floor prior to making their way to the  # index processor  TRANSFORMS -set= setnull, setparsing  In transforms. conf  [setnull]   REGEX = .   DEST_KEY = queue   FORMAT = nullQueue   [setparsing]   REGEX = debugmessage   DEST_KEY = queue   FORMAT = indexQueue