How to pull all data using Log Event Trigger Action

[tr_newman]

We are utilizing the Log Event Trigger Action for an alert and we'd essentially like to duplicate the event that's found into another index. There is some renaming that happens in the alert, so pulling the_raw wouldn't include the renamed fields correct? If _raw is the way to go, what is the token for this? $result._raw$?

[fredclown]

What do you mean by pulling the _raw? Do you mean "pulling" as in removing _raw from the fields list? Are you using the collect command to add the events into another index? If you do and don't explicitly set a sourcetype then you will not incur a licensing hit for the data copied to the other index.

[tr_newman]

We have a solution using the collect command, but the team we're engineering this for does not want the collect command in the alert because they often times use the search link to do investigations and will generate additional collections (which kick off tickets). So we're thinking the log event alert action might be better to use, but you have to manually define each field that you want.  Trying to see if we can just pull all the fields of the event into the Event Text.

[n0vsec]

I encountered a similar issue. My scenario involved comparing two alerts and wanting to write the results of the test alert to an index while maintaining the same configurations (like throttling) for both.  Using collect wouldn't work, because it was writing duplicate entries to the index due to the alert configuration.

I managed to achieve this by directing all the results to:

| tojson output_field="foo"

Then in the event field you can just enter:

$result.foo$