mortengrouleff
commented
5 years ago The new parsers allow retagging of events. Assigning a different repo should also be possible on-premises, but is currently only supported by the subset of the ingest methods that already allowed selecting the repo from a field in each event. Rewriting that event assigning that specific field using the parser works for those.
At the moment all events are routed based on their ingest path - this presents challenges when you want to ship multiple logfiles from a single machine to multiple dataspaces in Humio for example (and no, running multiple filebeat/whatever instances is not an acceptable workaround for larger setups).
It really should be possible to do the routing inside Humio - at least where such functionality is required.