You can configure event forwarding rules in the UI. Go to event forwarder.to see and manage the event forwarding rules that apply to the repository. This is only possible after creating at least one
To create an event forwarding rule, you specify a rule and select an already configured event forwarder.
The rule is a normal Humio query. It is applied to the parsed events, and can be used to filter away events you do not wish to forward, or add fields to or remove fields from the events before forwarding them. Any manipulation done to the events only apply to the forwarded events, the events stored in Humio will be the events that came out of the parser. The rule can contain any transformation function, but no aggregate functions, see query functions.
You need the EventForwarding permission to configure event forwarding rules.