We have data coming from lots of universal forwarders and it has various sources and sourcetypes and sending data only to a single index.
we don't have access to inputs.conf.
How can we redirect the data to a different index.
Can we use transforms.conf to work on that particular index (i,e changing index name for data based only on existing index )
↧