Been working with Pipelines and simple rules…which has been great.
But in this case, I am using a simple pipeline to move Windows event messages from the Sysmon log to my Sysmon stream. The goal is that we are breaking up our messaging into streams to get around the 1000 field index issues on our larger clients. The sysmon stream in this case is setup, with it’s own index applied to it, and messages are routing nicely. We have checked the box in the Sysmon stream to Remove Matches from the "All Messages’ stream.
The problem is that we have messages in the Sysmon stream as we would like, yet they are still in the All Messages stream. Obviously I am missing a step somewhere.
The pipeline has 2 simple rules
The first finds the Event Log for Sysmon
rule "sysmon logs"
** contains(to_string($message.Channel), “Microsoft-Windows-Sysmon/Operational”, true) **
then the next moves it to the Sysmon Stream, which has it’s own index setup
rule "Routes to Sysmon Stream"
This pipeline is executing from the All messages stream
All insight is appreciated