Variable | ALLOW_CHANGE_REPO_ON_EVENTS | |
Description | HEC allows ingest to any specified repository | |
Default | false |
If this variable is set to true
, the HTTP Event Collector
(HEC) allows ingest to any repository specified as
"index": "<repository-name>"
in the body of a message, as long as the ingest token is valid for any
repository. If the named repository doesn't exist, though, the event
remains in the repository designated by the ingest token.
This option is important for the copyevent()
if you
want to copy the event to another repository, it must be set to
true
.
This is a security vulnerability on a public API endpoint. Therefore, this option should be used only inside a trusted environment.