Deprecated: ALLOW_CHANGE_REPO_ON_EVENTS v1.36
This feature has been deprecated. However, the HEC API endpoint supports ingesting to specific repositories, repositories across an organization, or repositories across a cluster.
Variable | ALLOW_CHANGE_REPO_ON_EVENTS | |
Description | HEC allows ingest to any specified repository | |
Default | false |
If this variable is set to true
, the
HTTP Event Collector (HEC) allows
ingest to any repository specified as "index":
"<repository-name>"
in the body of a message, as long as
the ingest token is valid for any repository. If the named repository
doesn't exist, though, the event remains in the repository designated by
the ingest token.
This option is important for the copyevent()
if you
want to copy the event to another repository, it must be set to
true
.
This is a security vulnerability on a public API endpoint. Therefore, this option should be used only inside a trusted environment.