We have data in a database from which we get records with db connect. They contain, among others, a selection field. The events must be filled into different indexes based on the selector field:
Event=1 Selector=a => index_a
Event=2 Selector=b => index_b
Event=3 Selector=a => index_a
There might be hundreds of different values in the selector field and thus also hundreds of indexes. Using a own saved search or a search with a case statement is not really an option.
The events belong to different user groups and have to be distributed into different indexes to enforce access control. Using 'Restrict Search Terms' is not an option. I was thinking about something like
...| collect index=index_<>
This works obviously not ;-) has anyone a hint?
↧