How can my application send logs to different index's for compliance purposes
See original GitHub issueWhat happened: Currently i can send all the logs from a pod to a single index. What you expected to happen: We are migrating a lot of EC2 based application to EKS. Some security related logs on ec2 were written on file system and then sent to different index due to retention policy being higher compared to regular log file. In containers all logs go to a single index. Is there a way my application running on a k8s pod can send this to a different index ? How to reproduce it (as minimally and precisely as possible):
Anything else we need to know?:
Environment: EKS
- Kubernetes version (use
kubectl version
): 1.14 - Ruby version (use
ruby --version
): - OS (e.g:
cat /etc/os-release
): Amaxon Linux 2 - Splunk version:
- Others:
Issue Analytics
- State:
- Created 3 years ago
- Comments:16 (1 by maintainers)
Top Results From Across the Web
Indexes - Datadog Docs
Note: Logs enter the first index whose filter they match on, use drag and drop on the list of indexes to reorder them...
Read more >Logging - OWASP Cheat Sheet Series
Application logging should always be included for security events. Application logs are invaluable data for: Identifying security incidents; Monitoring policy ...
Read more >Configure custom indexing | Cloud Logging
Logging applies custom indexing to data that is ingested after the index was created or changed; changes to custom indexes don't apply to...
Read more >Exploring logging strategies with the Elastic Stack - kreuzwerker
This blog post will present two log indexing strategies and evaluate ... to send log streams over to a Logstash server where we...
Read more >What Is Log Management? A Complete Logging Guide - Graylog
Many compliance mandates have log storage and retention requirements, so you should be considering this as part of your log collection.
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
@limlengchye could you share the custom conf you are providing to send use multiple HEC token? i think it could be helpful if we can make it more native as well.
@matthewmodestino just a gentle reminder