You can configure event forwarding rules in the UI. Go to Repository --> Settings --> Event Forwarding to see and manage the event forwarding rules that apply to the repository. This is only possible after creating at least one Event Forwarders

Figure 26. Figure 1

To create an event forwarding rule, you specify a rule and select an already configured Event Forwarders.

The rule is a normal Humio query. It is applied to the parsed events, and can be used to filter away events you do not wish to forward, or add fields to or remove fields from the events before forwarding them. Any manipulation done to the events only apply to the forwarded events, the events stored in Humio will be the events that came out of the parser. The rule can contain any transformation function, but no aggregate functions, see Query Functions.