Before you begin, make sure you've set up Data Forwarding destinations.
- Go to Manage > Collection > Collection (Manage > Collection and click Collectors and Sources in the classic UI).
- Search for the source that you want to configure, and click the Edit link for the source.
The source must be associated with an installed collector.
- Scroll down to the Processing Rules section and click the arrow to expand the section.
- Click Add Rule.
- Enter a name to define the rule.
- In the Filter field, enter the regular expression that determines how the rule is applied. For example, the regular expression ,*ERROR*, matches all messages that contain ERROR.
- Select Forward messages that match as the rule type. This option is visible only if you have defined Data Forwarding destinations.
- Select the Destination from the drop-down menu. The menu is populated with the destinations that were previously added.
- Click Apply.
- Click to add any additional rules.
The added rule is listed along with any other previously defined processing rules. See Create A Processing Rule for more information.
- Click Save to save all of the rules you defined and start forwarding data that matches the rules.
- Configure additional sources as needed.