multiple HEC tokens

[aniketb]

I have a HEC token where my security logs come in from cloud. The App team also wants to send the logs here.
What's the easiest way of implementing this while keeping the index and access to logs separate.

Is it allowed to have a separate HEC token with new index on the same port? That way security logs go to security HEC token and app logs go to app HEC token and no firewall changes are needed

[masonmorales · Accepted solution]

Yes, it's possible. Take a look at https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/ for examples on how to generate GUIDs for new HEC tokens. You then add the GUID as a new http stanza in inputs.conf with the corresponding indexes it can access.

Here's what your config might look like

[http]
disabled=0
port=8088
dedicatedIoThreads=2
maxThreads = 0
maxSockets = 0
useDeploymentServer=0

[http://security]
disabled = 0
index = syslog
indexes = wineventlog,cisco,antivirus
sourcetype = syslog
token = 49775a02-74d0-43e1-845f-d57d0558bd45
useACK = 0

[http://applications]
disabled = 0
index = syslog
indexes = apache,myapp,etc
sourcetype = syslog
token = 0880377a-3d06-4da5-a36c-cea9e2022d40
useACK = 0