I don't seem to be able to filter by rule_uid, only by either action, blade or origin. Looking through the documentation in sk122323 it doesn't mention the rule_uid option. Perhaps I'm missing something?
Log Exporter would solve the case though, if i can get it set up with rule_uid filtering.
In $EXPORTERDIR/targets/<Name of Log Exporter Configuration>/conf/FilterConfiguration.xml
<field name="action" operator="and">
<field name="origin" operator="and">
<field name="product" operator="and">
<field name="rule_uid" operator="and">
This seems to work in my case. Appreciate the assistance.
@CPRQ In your case, i think you can add "neq" (not equal) as the value operation, in order to negate one rule, and export the rest.