There's not much you can do to prevent users from entering random index=foo lines into inputs.conf files without locking down the files or overwriting them from the DS. There are some things you can do that might help. Define a "last chance" index. Inputs with an index that doesn't exist will send their data here. You can set up alerts to notify you when data arrives here so the input can be corrected. Use Ingest Actions in the intermediate forwarders or indexers to redirect data to the correct index, if it can be determined (by sourcetype, perhaps). Use data from the last chance index to create a "Hall of Shame" calling out those who do not follow the proper onboarding procedures.
... View more