I have multiple forwarders (heavy and universal) and I want to manipulate the data they send to my indexers.
For each event I want to add a field, which the value is based on the event content and other information.
It is possible for me to add this field on search, but I prefer to do it before indexing the event and make the search easier.
Is it possible to do so?
↧