I am trying to trim up what logs I am sending to my SIEM. Currently I am sending all logs.
I've identified a particular IP and port that accounts for 30% of all logs sent.
I can't figure out how (or if you even can) send exclude an IP/port combo, but I can't even seem to get it to filter out just the destination IP.
Here is what I put into my filter config. after restarting the exporter I still am getting logs with the destination IP I tried to filter:
(Modified the IP for privacy)
<field name="action" operator="and">
<field name="origin" operator="and">
<field name="product" operator="and">
<field name="dst_ip" operator="and">
Any help excluding that destination IP is appreciated, and even more so if I can exclude all packets with a dst and a certain port.