topic Re: Routing to index from Heavy Forwarder in Getting Data In

Routing to index from Heavy Forwarder

knutsod — Mon, 28 Sep 2020 16:54:34 GMT

I have windows logs from a universal forwarder being sent to my heavy forwarder where I using props.conf and transforms.conf to only allow specific event id through. Now I am trying to make the events go to a specific index on my indexer. In my transforms.conf stanza that filters the events I had:
[security] REGEX = (?m)EventCodes=(listOfEventCodes) DEST_KEY = queue FORMAT = indexQueue
I changed this to look like this:
[security] REGEX = (?m)EventCodes=(listOfEventCodes) DEST_KEY = _MetatData:Index FORMAT = securityindex
I expected to see the new events in the securityindex on my indexer, what I found was the my event where not even coming to my indexer anymore. I assume that the data pipe was trying to index the events locally on the heavyforwarder and not sending them to the indexer.

So my question is, is there a way to define what index an event should go to on the indexer from the heavy forwarder configs?

Re: Routing to index from Heavy Forwarder

MuS — Tue, 24 Jun 2014 06:18:11 GMT

Hi knutsod,

see the docs about route and filter data for some nice examples. Remember to enable forwarding on the heavy forwarder, else it will not send the event to the final indexer. Last but not least, don't forget to create the index on the receiving indexer.

cheers, MuS

Re: Routing to index from Heavy Forwarder

lguinn2 — Wed, 25 Jun 2014 00:55:49 GMT

DEST_KEY = _MetatData:Index

has a typo. It should be

DEST_KEY = _MetaData:Index