How to populate a summary index created with alerts that have the collect option on them?

[borja_luaces]

Good morning all,

First of all, I have to say that this question may have been already answered but I have not been able to find a reply that fits with what I am looking for.

I got a set of rules that run on real-time where last field in the rules is "| collect ". At the same time I have created the index via the index cluster and deploy it to the indexers and checked that the index exists in our indexers.

The thing is that when I make the rules trigger I do not see the event being generated at the destination index but I do see it at the triggered alerts view.

How can I populate the summary index I created with the alerts that have the collect option on them?

Regards.

[adonio]

why use collect for this? why use real time is another story, but regardless, when saving your alert, under your alert actions, just add "log event" and specify the index

hope it helps

[dto20]

But "log event" only works if you have the index on the search heads. What do you do if your summary index is on an index cluster?