Hi, Perhaps this question has been asked before... Is it possible to store events coming from the same source in different indexes, depending on their content? The use case is that some events are more sensitive than others and need to be sent to different indexes. In our case, the index name would appear within the event, as a formatted field, like [index: SENSITIVE]. The input is a TCP port. Any help would be appreciated, and I prefer to take no as an answer than to be led into some intricate solution. Thank you, Jean
... View more
