I have a stream called auditd using index set auditd.
Pipeline processor is after Message Filter chain in the configuration
I have a pipeline rule with
route_to_stream(name: “auditd”, remove_from_default: true);
Message says it was routed to stream auditd but the message is stored in the default index so it is not searchable in the stream.
Stored in index
Routed into streams
I would like the message to be routed to stream auditd and be searchable in the stream. Is this possible?