Onboard Windows event log based on source name

[jasonlow]

Hi. How would I ingest Windows Application events from a specific source name (and drop everything else)? For instance, ingest events with source MSSQLSERVER into the mssql index; source MSIINSTALLER into the msi index. It would be done with regex in transforms.conf, right?

[richgalloway]

Specify the index name in inputs.conf.