Hi,
I am almost there on this task but need some assitance please on how to target different indexes. I have a number of UF's sending WinEventLog to HF's. The HF has the prop/trans to send to two different instances. I now need to send it to different indexes i.e. instance1=indexa, instance2=indexb.
This is my current props/transforms files. (hostname used initially to simplify)
props.conf
[host::hostname]
TRANSFORMS-routing = dual_ship
transforms.conf
[dual_ship]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=group1, group2
Then I have outputs.conf with the groups within the tcpout stanzas.
Thanks in advance 🙂
