Is it possible to aggregate logs from cef input

in the aggregation, how can I make sure that the base events are deleted and not emitted to the elasticsearch and only the aggregated event was emitted?

That's what the event.cancel does. To check if it is working do a search for NOT _exists_: aggregatedEvents

Would you show me where I can put this code please

It is already present as the first line of your code.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.