How to config watcher to output event to index?

Elastic Stack Elasticsearch
1

Hi all,
I currently use elastic to store log file.
Can some one tell me how to write the watcher to have the output to an index,
I want whenever there is a something that matche my query then watcher will output the whole event(data) to an index

For example: if there is some user log in with error credentials then watcher will output the whole logfile to an index

Please help me

Thank you

2

You can use the index action for that.

3

Yes thank you but can you tell me more, because i have tried to use the index action and it only index the number of result for me and the the actual data itself

4

sharing your watch would be a tremendous help, as then there is a base to discuss and change the action.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.