I have many many events and they are all useful but there is a subset that is most important. I want to keep all events in the primary index and then for efficiency (dashboards and searches) create a separate index with just the important events. (I use summary indexes for top level charts which works great but when I drill down from the chart retrieving the events is very slow - which is why I want to create the intermediary index with just the important events). I've been trying variations of props.conf and transforms.conf to write the important events to a second indes. props.conf [source::/var/log/ftauditevents] TRANSFORMS-index = ImportantEvents transforms.conf [ImportantEvents] REGEX = DEST_KEY = _MetaData:Index FORMAT = important_index The problem is that the important events are not written to the primary index - and I still want the primary index to contain all events for other purposes. Any suggestion? ... View more