We're only seeing the following indexes:
We aren't seeing any of the event_tag= fields. Any help is appreciated.
I have this data coming through a heavy forwarder, ended up putting the props.conf on the heavy forwarder... it's working now.
View solution in original post