Logging.json - agent sends some logs to collector/event source and some to R7 endpoint

InsightIDR
1

I am able to use logging.json to configure the agent to either send logs directly to R7 or to send to an Event Source (network port). I’ve not managed to do both at the same time.

Is this possible, and how?

2

No this is not possible, it is only possible to send all data directly or all data via a collector when using the datahub parameter

David

3

So if I’ve got different types of text-only/unstructured logs on one box that I want to pass through different event sources, this is not possible?

This is … limiting.

4

That is correct you would need to use something like nxlog to achieve the output you describe