Deprecated: ALLOW_CHANGE_REPO_ON_EVENTS v1.36

This feature has been deprecated. However, the HEC API endpoint supports ingesting to specific repositories, repositories across an organization, or repositories across a cluster.

VariableALLOW_CHANGE_REPO_ON_EVENTS
Description HEC allows ingest to any specified repository
Defaultfalse

If this variable is set to true, the HTTP Event Collector (HEC) allows ingest to any repository specified as "index": "<repository-name>" in the body of a message, as long as the ingest token is valid for any repository. If the named repository doesn't exist, though, the event remains in the repository designated by the ingest token.

This option is important for the copyevent() if you want to copy the event to another repository, it must be set to true.

This is a security vulnerability on a public API endpoint. Therefore, this option should be used only inside a trusted environment.