I have a stream with following rule,
Field message must match regular expression .*severity="warn".*
also have set an Alert once this appear then alarm me! but I get maybe over 1000 logs like this everyday.
I want to filter this like below
if a value= .*severity="warn".* AND "client="clear_cache_data.plx" then don't email or alarm me!
can anyone help me with this?