Option | ALLOW_CHANGE_REPO_ON_EVENTS | |
Description | HEC allows ingest to any specified repository | |
Default | false |
Deprecated:ALLOW_CHANGE_REPO_ON_EVENTS v1.36
This feature has been deprecated. However, the HEC API endpoint supports ingesting to specific repositories, repositories across an organization, or repositories across a cluster.
If this variable is set to true
, the
HTTP Event Collector
(HEC) allows ingest to any repository specified as
"index":
"<repository-name>"
in the body of a message, as
long as the ingest token is valid for any repository. If the
named repository doesn't exist, though, the event remains in the
repository designated by the ingest token.
This option is important for the
copyEvent()
if you want to copy the event
to another repository, it must be set to true
.
This is a security vulnerability on a public API endpoint. Therefore, this option should be used only inside a trusted environment.