Writing to two data streams

We are collecting logs and uses fleet with agents.
I would like to configure some agents to write data in two data streams instead of just one.
As far as I can understand you specify the data stream to use in the integration config in the dataset name field but I think you can only specify one data set there.

The use case is to have a separate data streams for some application logs but also have the same data in a data stream used for security logging, I could then have different permissions on the data streams.

1 Like

Your two options are;

  1. Use field and document level security
  2. Use an ingest pipeline to split the data into different indices, then secure them from there

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.