I am trying to forward http input to specific to outputs group with _TCP_ROUTING, but events get forwarded to default outputs group.
**inputs.conf**
[http://abcd]
disabled = 0
_TCP_ROUTING = abc_indexers
index = main
token = XXXXX
**outputs.conf**
[tcpout:abc_indexers]
server= indexer1:9997
[tcpout:xyz_indexers]
server = indexer2:9997
[tcpout]
default = xyz_indexers
With above configuration, HTTP Event Collector (HEC) forwards data to default group xyz_indexers. This same setup works fine for monitor or script or rest input.
↧