Getting Data In

route attribute in inputs.conf


Can someone could explain the route attribute in inputs.conf

route = haskey..

What is matching rule here mentioned

Tags (2)
0 Karma


The only time I've seen that setting used is when you want to re-parse cooked data. If you have data from a heavy forwarder going to an indexer, normally none of the indexer's index time props and transforms apply. This is because the data has already been 'cooked' (processed) by the heavy forwarder. You can change the route to force data to pass through parsing queues it would normally skip.

Don't confuse this setting with more commonly used data routing settings, where you might want to forward some data to a 3rd party, to a different set of indexers, or drop a subset of events:

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!