I would like to use indexRouting to move some log lines to a given index and have other log lines go to athe HEC's default index. The log lines that I want to route are single-line json formatted as a HEC event. Below is a pretty-printed example: {
"event":{
"device":{
"id":"dcef6f000bc7a6baffc0f0b5f000",
},
"logMessage":{
"description":"Publishing to web socket",
"domain":"WebSocketChannel",
"severity":"debug"
},
"topic":"com.juneoven.dev.analytics"
},
"index":"analytics_logs_dev",
"level":"INFO",
"source":"dev.analytics",
"sourcetype":"analytics-logs",
"time":1630091106.076237
} Other log lines are normal text logs (non-json formatted): 2021-08-27 19:09:14,295 INFO [tornado.access] 202 POST /1/analytics/log (10.110.4.224) 35.62ms I see that there is a customFilter feature. I am hoping that Ican key off of the 'index' field in the HEC event to route these json log lines to their index and allow all other lines to go to the default index for the HEC. Is that possible? Is there some documentation that would help me? Thanks.
... View more