Trying to resolve an issue with routing log events. The goal is to route log events with an "Api" keyword to a separate index. Here is a log sample of three events (the first has no "Api" embedded, the next two have "Api"):
Good morning. As suggested, I have tried separating the sourcetype and the index TRANSFORMS. As I am now seeing API data in the API index, I am good with ...
But for the ...
As all the IIS data is being stored in the IIS index, it appears the parsing is not happening. The goal is to simply store IIS data (and not API data) in the IIS index. Do you have any other suggestions?