Routing to index from Heavy Forwarder

[knutsod]

I have windows logs from a universal forwarder being sent to my heavy forwarder where I using props.conf and transforms.conf to only allow specific event id through. Now I am trying to make the events go to a specific index on my indexer. In my transforms.conf stanza that filters the events I had:

[security]
REGEX = (?m)EventCodes=(listOfEventCodes)
DEST_KEY = queue
FORMAT = indexQueue

I changed this to look like this:

[security]
REGEX = (?m)EventCodes=(listOfEventCodes)
DEST_KEY = _MetatData:Index
FORMAT = securityindex

I expected to see the new events in the securityindex on my indexer, what I found was the my event where not even coming to my indexer anymore. I assume that the data pipe was trying to index the events locally on the heavyforwarder and not sending them to the indexer.

So my question is, is there a way to define what index an event should go to on the indexer from the heavy forwarder configs?

[lguinn2]

DEST_KEY = _MetatData:Index

has a typo. It should be

DEST_KEY = _MetaData:Index

[MuS · Accepted solution]

Hi knutsod,

see the docs about route and filter data for some nice examples. Remember to enable forwarding on the heavy forwarder, else it will not send the event to the final indexer. Last but not least, don't forget to create the index on the receiving indexer.

cheers, MuS