Hello,
i have three index : A, B, C on my heavy forwarder and i want to forward to different receiver,
example : A to X, B to Y and C to Y too
How can i do that ?
Thanks,
First, if you actually have indexes on your forwarder - it isn't just a forwarder anymore, it is also an indexer and it needs a license.
Second, if you can, route the events to the receiver based on sourcetype or source or host - not index, if possible:
props.conf
[sourcetypeA1]
TRANSFORM-a1=routeToReceiverX
[sourcetypeA2]
TRANSFORM-a2=routeToReceiverX
[sourcetypeB]
TRANSFORM-b1=routeToReceiverY
etc
transforms.conf
[routeToReceiverX]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverXGroup
etc
outputs.conf
[tcpout:ReceiverXGroup]
server=ReceiverX:9997
[tcpout:ReceiverYGroup]
server=ReceiverY:9997
If you must route based on index, do this in props.conf and transforms.conf instead (outputs.conf stays the same):
props.conf
[host::*]
TRANSFORM-h1=routeToReceiverX,routeToReceiverY,routeToReceiverZ
transforms.conf
[routeToReceiverX]
SOURCE_KEY=_MetaData:Index
REGEX=A
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverXGroup
[routeToReceiverY]
SOURCE_KEY=_MetaData:Index
REGEX=B
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverYGroup
I am not entirely sure that this second method will work...
Here is a link to the documentation on Route and filter data
First, if you actually have indexes on your forwarder - it isn't just a forwarder anymore, it is also an indexer and it needs a license.
Second, if you can, route the events to the receiver based on sourcetype or source or host - not index, if possible:
props.conf
[sourcetypeA1]
TRANSFORM-a1=routeToReceiverX
[sourcetypeA2]
TRANSFORM-a2=routeToReceiverX
[sourcetypeB]
TRANSFORM-b1=routeToReceiverY
etc
transforms.conf
[routeToReceiverX]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverXGroup
etc
outputs.conf
[tcpout:ReceiverXGroup]
server=ReceiverX:9997
[tcpout:ReceiverYGroup]
server=ReceiverY:9997
If you must route based on index, do this in props.conf and transforms.conf instead (outputs.conf stays the same):
props.conf
[host::*]
TRANSFORM-h1=routeToReceiverX,routeToReceiverY,routeToReceiverZ
transforms.conf
[routeToReceiverX]
SOURCE_KEY=_MetaData:Index
REGEX=A
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverXGroup
[routeToReceiverY]
SOURCE_KEY=_MetaData:Index
REGEX=B
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverYGroup
I am not entirely sure that this second method will work...
Here is a link to the documentation on Route and filter data
thanks lguinn,
Damien