Pushing data to only one output occasionally

[Zakouille]

Hello, here is a very basic EventFlow config which works fine :

{
  "inputs": [
    {
      "type": "EventSource",
      "sources": [
        {
          "providerName": "foo",
          "level": "LogAlways"
        }
      ]
    }
  ],
  "outputs": [
    {
      "type": "ApplicationInsights",
      "instrumentationKey": "foobar"
    },
    {
      "type": "Http",
      "serviceUri": "foobar",
      "format": "Json",
      "httpContentType": "application/json",
      "headers": {
           "Authorization": "foobar",
      }
    }
  ],
}

However, there are occasionally some logs I would like not to send to the Http output but still send to the ApplicationInsights output.

What's the best way to achieve this ? I have a feeling we could maybe use the 'level' attribute of a log but I'm not sure at all if that's the correct and easy way.

Thanks for your help.

[karolz-ms]

@Zakouille this is easy to do in EventFlow: use an output-specific filter.

If the rule for excluding logs from HTTP output can be stated as simple boolean expression, you can use the built-in "drop" filter. If the rule is more complicated, you can use a custom filter and implement the logic in code.

Hope this helps!

[Zakouille]

It does! Thank you!