Modifying data format, on a per-destination basis A customer asked this: We have multiple syslog senders routing their messages to Cribl. Each of the senders has an event format that's specific to the source. And, we are routing those events to multiple destinations which also require their own format, such as CEF format for our security tool, JSON format for our logging tool.What's the best way to handle the processing of these events, so they're correctly processed and formatted correctly for the destination?Here is the example scenario:We have devices sending via syslog 514 ie (f5s, Cisco ASA, Cisco routers, cisco switches, storage gear, Palos, etc.) All the syslog messages would be different based on the vendor. Some (like the PAN) have a single device sending multiple different formats.We're doing filtering, enrichment, reformatting on the events. We're prioritizing this effort based on volumes.Once processed, events are sent to different destinations. Lets say we have 3: one requires JSON, one CEF, and one requires a single
