Hello all, we're using Elasticsearch to index Windows event logs and keeping them for 6 months; what I would like to do is reindex a subset of data such as:
- user creation/deletion events
- group creation/deletion events
- interactive user logon events
...to another index that will be kept for longer. I'd like to do this at the same time as events are going into the main Windows event log index but as far as I can tell you can't write the same data to different indexes simultaneously.
Can anyone tell me what my options are?