How to apply Syslog filter on Local Collector/Decoder

[AmitKumar1]

Hi Everyone,

I am getting unidentified logs from F5 and one of the solutions available on RSA KB is to filter that logs on Syslog filter.

But the issue is Syslog filter is only available on Remote Collector. Is there any way we can create a Syslog filter on Local Collector/Decoder to remove unwanted raw logs.

Regards

AMIT

[EricPartington]

I dont think that is possible.

this is how you can filter those from a VLC 

https://community.rsa.com/community/products/netwitness/blog/2016/11/25/filtering-f5-udp-syslog-health-checks 

but no filtering option exists on the LD that I am aware of.

[dougds]

Hi Eric

Do you have found something about the feasibility of it? 

Regards,
Doug