I have many many events and they are all useful but there is a subset that is most important. I want to keep all events in the primary index and then for efficiency (dashboards and searches) create a separate index with just the important events.
(I use summary indexes for top level charts which works great but when I drill down from the chart retrieving the events is very slow - which is why I want to create the intermediary index with just the important events).
I've been trying variations of props.conf and transforms.conf to write the important events to a second indes.
props.conf
[source::/var/log/ftauditevents]
TRANSFORMS-index = ImportantEvents
transforms.conf
[ImportantEvents]
REGEX =
DEST_KEY = _MetaData:Index
FORMAT = important_index
The problem is that the important events are not written to the primary index - and I still want the primary index to contain all events for other purposes.
Any suggestion?
I have the same requirement here, I know we will use more licences but we need some events in more than one index, did you find a solution?
If we write the data to two indexes, you will be using more license than necessary.
In your situation, I would consider:
I hope that helps.