Writing to two data streams

Elastic Stack Elasticsearch
1

We are collecting logs and uses fleet with agents.
I would like to configure some agents to write data in two data streams instead of just one.
As far as I can understand you specify the data stream to use in the integration config in the dataset name field but I think you can only specify one data set there.

The use case is to have a separate data streams for some application logs but also have the same data in a data stream used for security logging, I could then have different permissions on the data streams.

1 Like
2

Your two options are;

  1. Use field and document level security
  2. Use an ingest pipeline to split the data into different indices, then secure them from there
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.